Valve fucked up but the Verge still broke the social contract regardless of whether they’re legally in the clear or not.
Doing something just because “it’s legal” doesn’t make it a moral justification. My wife and I have a joint bank account. It is legal for me to take money from it and gamble it all away, the gate is “open” but that doesn’t make it morally justifiable.