Comment by cornholio

It's not illegal for vendors, they just have to colaborare with law enforcement when a subpoena is received, and this collaboration can entail attacking their own users as long as a technical capability to do so exists.

If you think about it, it's more or less the only way this could work in any democratic society.