Depends on your definition of legit. Sites like it and G2A are basically like eBay. Some are legit leftovers from Humble Bundle and other authorized retailers, and some are from vouchers for games or services that sell physical cards, those are all what I'd say are legit. Then there are gray area codes that might be review codes, I don't know how to classify these ones. There are some people (this is an issue on eBay too) buying games with stolen cards or PayPal accounts, selling the games, and then eventually the rightful owner likely gets the charges reversed. The keys could very well get deactivated in the future meaning you're now out money. These are the bad sellers and bad keys people warn against the site for. There was a game where a ton of keys were revoked because playerd buying the game from G2A sellers weren't getting their keys.
Only buy from sellers with several/tens of thousands of feedback ratings and don't buy any new title on any sites like this. Same goes for eBay. Use PayPal too, because then you can easily get a refund and don't have to worry about your credit card. I believe payments are sent to the company which then gives it to the sellers. Also, if it's too good to be true, it probably is. You're not finding 50% off new titles if they're legit* unless its a review code, and if it's not it's likely fraudulently obtained. Checking what the game goes for during Steam sales is a good way to check prices.
