Who the fuck cares? Mojang doesn't do shit about it, Microsoft doesn't do shit about it, nobody does shit about it, people still buy/use them.
If finding account lists online and using a checker on them is illegal, then what the fuck is legal? If they crack their own accounts and check them, it's still *technically* legal, because people haven't secured their accounts.
Then again with this logic you could say if a guy killed me, made sure I was dead, and claimed "it's legal because he wasn't looking out for himself".
Cracking and checking accounts doesn't make it right, but they need to make money somehow, don't they?