The symbol for M2 in the simulation schematic shows that the source is grounded and the drain is connected to VBUS. The connection is correct, as the drain current begins to flow when the gate voltage is positively biased.
By the way, what do you think this circuit protects from what risk?
I think it is a meaningful protection circuit if the external power supply over 5V connected to VBUS detects the overcurrent of XIAO and turns off automatically.