You're not allowed to have hacked 'mons in your party, no, but seeing as how it's impossible to distinguish a legitimate Pokemon from a carefully hacked one with identical stats, a lot of hacks make it in. Pokemon are just data in the end, and data can be fudged if the user knows what he's doing. Some people hack their teams from scratch, others do most things legit but cut corners with fast hatch codes or cloning codes and whatnot, and others go 100% legit. I don't really have an opinion on hacking one way or the other as long as the end result is legal, and I also do not have much sympathy for people who get caught. It's just an aspect of the game you gotta come to terms with. I wouldn't recommend risking it yourself, though.
Soft-resetting for ideal stats is obsolete, btw. RNG abuse makes perfect legitimate Pokemon possible in about half an hour per individual Pokemon, at least after the initial learning curve. All 31s ain't a thing. I sigh every time some poor trainer shares his account of a wasted afternoon SRing in front of a legend or filling up a box with subpar hatchlings. Get with the program, dood. Or just ask someone trustworthy to do it for you.
Perfect stats aren't nearly as important as general knowledge about the game is anyway. Last year's US champ RNG abused for shininess but had mostly random IVs. It's nice to have an edge, yeah, but I'm really not kidding when I say you shouldn't sweat a difference of a few stat points.
