Most major poker sites have detection protocols to prevent bot play, but some of the more sophisticated bots are able operate undetected, and some poker sites simply don't care about bots since their play produces rake (though, they will ban a bot if they catch it, or if it's reported).
It's clear that these bots hurt poker players, which is why online poker companies work so hard to get rid of them. But they're not actually breaking the law. They're just being evil, which isn't in and of itself illegal.