Good question. Probably in a jurisdiction Valve can't touch, or they're just indexing stuff without hosting the actual files. Either way, it's risky. Valve's lawyers are definitely already on it