For future reference, the terms legal and legitimate are NOT the same thing.

Legitimate = Was obtained in game without the help of any 3rd Party Hacking Tools
Hacked = Was obtained via a 3rd party save editing modification tool and/or by means that a person who just has access to the game itself would not be able to obtain. - PkHex is by far the most common.
Legal = The game does not flag it as being "hacked" and the mon itself is something that is theoretically obtainable in game, even if it is a super slim 0.1% chance.

Just because a pokemon is hacked does not mean it is not "illegal," if it is done properly it is as legal as any other legitimately obtained pokemon. Hacked Pokemon can be legal. It's still hacked though (i.e, obtained with 3rd party software). Meaning, any person looking at a good hack / clone cannot tell you without a doubt if it is 'legitimate' or not, just that there is no indication of it being hacked.

For example, clones of legitimate Legendaries are hacked, but they are legal.