Regarding the specific question of "[how] is this legal", the answer is that students have to have signed a contract at some point agreeing to university policy

Regarding the specific question of "[how] is this legal", the answer is that students have to have signed a contract at some point agreeing to university policy which includes such a clause. This might be something as simple as "I agree to abide by the rules of the university handbook, including future changes." I suspect that in many cases there was no such agreement, but universities get students to transfer ownership by signing letters of understanding after being threatened with scary lawsuits. Basically a mob shakedown. That was the situation in my case, there was nothing I agreed to in writing, but they asserted they had such rights and intended to sue if I didn't sign over ownership. Just that they question ownership publicly is probably enough to ensure that former student led ventures never acquire funding or are abandoned due to the uncertainty. Nowadays clicking buttons on web sites is considered by some courts to be the same as signing a written contract, so this might be another way to get students to agree to absurd things, the same way many internet based companies do. Without a legal agreement the rights are held by the creators of the work. Since it is not work for hire because undergrad students are not employees, the students own the work. Grad students on the other hand are usually employees and also have signed contracts explicitly turning over ownership of work, so how it works is more clear there.