It IS legal.
Most of those "companies" don't bother on reporting with the SEC because that carries audited financial costs and a clean shell has neither assets, liabilities nor an operating business to be able to pay for those costs.
Most times shells are the remains of a former failed business that fortunately didn't get into debt, with their listing as their only asset, that can be used for either implementing another business idea by its owners, or selling it into a real company that wants to go public by using the Reverse Merger route as it's WAY cheaper than going thru the burden and costs of an IPO.
If every company that wanted to go public had to go through an IPO, it'd require an already existing privately-held business generating several million $$$ a year just to get started, there would be no place for people on the markets with an idea but no real money.