There's a big difference between the two. Legitimate means it was generated by the game itself, whereas legal encompasses anything from the game itself, and anything created externally by a program such as Pokegen that could be possible in the game. One could even argue that due to the terrible Nintendo hack checkers, that anything that passes those is legal, such as Sejun's Follow Me Magmar he used recently (Despite being completely impossible to get such a spread for it).
I think he means in terms of stats and such. Legit is legal, and legal cannot be proven to be legit or hacked without knowledge outside of the stats.