It operates legally because there isn't a law against it in the jurisdiction in which it operates. What part are you surprised isn't forbidden? The part where

It operates legally because there isn't a law against it in the jurisdiction in which it operates. What part are you surprised isn't forbidden? The part where it accepts connections anonymously? The part where data is encrypted in transit? Exit node operators, like telecoms can be required to tell law enforcement everything they know about a user. The difference is they don't know anything of value.