I suspect (although this is just speculation) that the authority is based on the fact that the Bitcoin Foundation is transmitting a lot of money to and from citizens of California. If, indeed, the Bitcoin Foundation were responsible for all bitcoin transactions (including those in California) then the legal authority would be clear. Perhaps California officials are simply mistaken and ill-informed about how bitcoin functions.