In some instances it's a simple, if not haphazard process. The al-Husayn was a modified SCUD-B, lowing the warhead to 300kg from 500kg, but increasing the range as a result, to roughly 650km versus SCUD-B's 300km range. Less warhead equaled a doubling in the effective range of the missile. The wobbling flight profile from this unbalanced modification also made the missile more difficult to intercept as its flight path was more erratic and hard to predict for PAC-2's fire-control systems at the time.
Al-Hussein was a SCUD-C modification, while Al-Hijarah was a chemical dispensing variant of Al-Husayn.
Each modification improved upon the range of the base SCUD model they were derived from, but all also had the "tumbling warhead" side-effect from being imbalanced. This would lower their accuracy, increase their range, but also reduce the effectiveness of counter-missile capabilities.
For the Yemeni Army which still operates and launches SCUD variants, Borkan 1 included, this wouldn't be a major modification, especially if they're receiving foreign technical assistance. All-in-all it's very doable.
And if the goal is a form of terror bombing, as seen with V-2 strikes against London during WWII, then the lessened accuracy from these modifications wouldn't be a major concern if firing at a large, sprawling target like Riyadh.
...
Borkan 1 is a SCUD derivative.
Ultimately developing a modified or updated variant with a longer range or better accuracy isn't beyond the technical capabilities of the Yemeni Army.
Yemeni cooperation with North Korea and Iran may also help explain the emergence of Borkan 1. North Korea has a number of modified variants such as Hwasong-5, a derivative of SCUD-B which Yemen is known to possess.
Using North Korean technical knowhow and possibly help from the Iranians or other sympathetic parties, it's completely plausible Yemen designs or developed its Borkan 1 itself, even with a lack of money and skilled labor, though I wouldn't put their military technicians in the later group.