Well, they do carry different meanings, which are useful for trading/battling.
Legal means that the Pokemon has stats, moves, natures, etc. that are consistent with it being caught in a specific location, at a specific time, under a specific condition, or bred under XYZ circumstance - that is, it looks like it has been caught/bred. Clones are legal, for example. RNG'd pokes are legal also. Pokemon with undistributed Hidden Abilities are illegal, even if the spread is good. Pokemon with distributed Hidden Abilities which are female can be illegal if all the ones that have the HA are distributed as male.
Legit is similar to legal, except the Pokemon was actually "caught"/bred in some way. This is desirable if, say, you wanted a certain Keldeo that was actually obtained from a Mystery Event, or a TRU Dragonite that was gotten when the event was going on, and not just duped. Legit is a subset of legal. RNG'd pokes are legit (though you'd be hard-pressed taking your Garchomp caught in 2026 into a tournament, I'm guessing). Pokemon distributed from dumps of distro carts are in a similar grey area, depending on how you look at it. Clones of legit pokes are legal, but not really legit themselves, but you may or may not care, depending on what sort of collector/breeder/battler you are.