Legitimacy is more about representing the people and ruling with consent. It's a spectrum, not a binary. The Saudi royal family have a patronage system in place that funnels money down to the regions and the tribes in return for loyalty. The country has no democratic traditions or expectations. For all they're a horrible dynasty of murderous autocrats, it's actually not that simple to argue that they don't rule with consent.

As governments get more oppressive and arbitrary in their exercise of power, it becomes harder for them to make credible claims of legitimacy. I'm not saying the Saudi government is legitimate, but it is possible for it to do things that increase or decrease it's relative legitimacy. Increase consultation and individual freedoms? More legitimate. Crack down on peaceful protests or oppress minorities? Less legitimate.