It's legit. If you have G2A shield and the purchase gets revoked or something, youre covered. Ive used it plenty of times with 0 issues
Again, there's some subjectivity, and even a bit of a moral decision, to whether to call them "legit"
The keys are mostly bought during things like steam sales and then resold after the sale. Nothing wrong with that. But the keys could be sourced from places like humble bundle, buying a ton of copies for a penny each to resell them for several dollars more. Considering that humble bundle purchases go to charity, it isn't a business model I want to support. I'd rather support the charities and developers than some guy who paid them a penny
There's also the fact that CD keys are an allowed form of steam account recovery. So there's a risk (small, as long as the sales platform doesn't expose things like email or anything else identifying to the seller, But much greater if you're direct buyer to seller or if the sales platform doesn't cover email) that someone could sell you the key, then turn around to steam support and say "hey that's my account, see, here's my key"
If the key came from a stolen card, and the card owner disputes it, not only does the retailer have to refund that money, but also pay a chargeback fee, which ends up costing them more than you saved. And then there's also that risk of being banned if your key came from a stolen credit card
I can't find anything on their site, but some people in other threads about g2a are saying they'll sell region locked keys, then tell you to use vpn to activate them... which is a really big risk to your steam account, as it's against the tos and easily traced
Buying from unauthorized sellers is against the steam tos
All these risks may be a small minority among other 100% legit keys, but I'd rather just buy straight from the source and know I'm facing 0 risk and that all my money is going to the parties who deserve it. And if something does go wrong with these services, the time taken to fix it wouldn't be worth the couple $ I saved
Edit:
If you have G2A shield
Wait, you have to buy an extra service in order to have a guarantee that your purchase even
works? That's kind of stuffty lol, that's something a good retailer is just going to give you implicitly with any purchase