Universal has to have proof of vaccination or negative test when they qualify as a mega-event (over 10,000 guests) but don't actually check on low attendance days. Once attendance gets a little higher, they don't go into the park to check everyone but just start checking people who enter. So technically, they're breaking the law but it's good enough for everybody involved.