This is a good question, not just about synthetic CDOs, but about derivatives in general.

I don't know the answer. A quick Google search suggests bucket shops were made illegal in the US, but I don't know the details, or why this doesn't make derivatives illegal.

One rationale for regulation I could imagine is to protect 'investors' from counterparty risk in case the bucket shop is inadequately hedged. Presumably synthetic CDOs were manufactured from derivatives whose counterparties were big banks, which are subject to capital adequacy requirements which in theory provide some protection.