That's also where most other key sites get their keys from (mostly from bundles). It has been shown time and time again that keys being purchased with stolen credit cards is mostly a myth. Just look at the fact that Factorio, which never had a sale and never sold a single key in a bundle, is just as expensive on key sites as on Steam (Source. That wouldn't be the case if criminals where purchasing licenses with stolen credit cards and then selling them for cheap as a form of money laundering.

Where are criminals even supposed to purchase those keys? Only the developer (and publisher) themselves can generate keys. You can't obtain them through Steam.