It's only illegal to access a device without authorization, and they only sell to law enforcement (who presumably have a warrant or whatnot, and thus authorization) so Cellebrite themselves isn't accessing anybodies systems.