They use the same model (SLOSH) that produced that map. It's important to remember that your map shows the "MOM" or maximum of maximums. It's basically the theoretical maximum that can occur at every location for a given category hurricane. It's very unlikely anyone will actually hit the values shown on that map.
For the storm surge forecast they take the NHC forecast track and run the model up to 250 times making slight changes to the official forecast based on the historical forecast error (basically the cone). But not only do they account for the error shown by the cone (called the cross-track error), they also account for forward speed error (which is important when accounting for tides which the model does), intensity error, and size error. After running these ~250 slightly different tracks, they produce the storm surge inundation map which shows the "reasonable worst case scenario". For the forecast the use the storm surge values that have a 10% chance of happening.