You have to define legal. In the case of pot, it's not actually legal - the feds simply choose not to enforce the law in states that have legalized it at the state level. There is substantial risk there as a payment processor. If it were actually up to the states, then it could be more like you describe.