Dates back to at least XP with Windows. The string that was checked in XP was very simple and later versions were digital certificates. Windows 10 OEM (started with 8 iirc) use per machine fingerprinting and have individual keys.
https://en.wikipedia.org/wiki/System_Locked_Pre-installation
System builder licences are fairly cheap but the EULA for them state that they are for putting on a new machine and selling that hardware on, if your building a machine for yourself you need a standard licence.
As for the cheap licences found on sites such as Kinguin. Speculation is a number of keys on these sites come from stolen CC's. Buy keys from legit sites with stolen Cc, sell the codes on Kinguin/G2A. Legit store is hit with charge back once CC holder realise they had their card has been used. It's been a fairly regular complaint in the indie games industry http://tinybuild.com/g2a-sold-450k-worth-of-our-game-keys
http://www.guytechie.com/articles/2010/2/25/how-slp-and-slic...
That's not to say there aren't ways around that, but it might be on a different level than just selling an OEM license.