It’s against the EULA, but nobody is going to get caught. The main issue is that it’s a pain in the ass and doesn’t scale. You can do this for one person, but most people aren’t going to be cool sending a payment to an address and just waiting around, hoping that they get a key. This is why Steam exists. There are other services that do the same thing that are not US based. GOG is based in Poland, for example: https://en.wikipedia.org/wiki/GOG.com