Since so many players play at Bovada and since this is the brand that stands out among many others, we can definitely say: The players have confirmed that Bovada is legit. So for one reason or another, Bovada opted for not going down the legal route that was opened to online operators and chose to stay an offshore operation. In recent times, when it became possible for online casinos to get licenses in New Jersey, Delaware, Nevada, and Pennsylvania, Bovada chose to stop accepting players from those states. However, Bovada secured a license from Curacao eGaming in early 2001, and so this issue has been addressed. So, if we look at the legal aspect, Bovada was definitely in the gray area. Bovada used to operate under a Kahnawake Gaming license until late 2016, and it then elected to operate without a license.
Still, there are foreign jurisdictions that do provide official licenses to worldwide real money gaming companies. Bovada, as a US-facing brand, can't have any state-issued gambling license as no governing authority within the country is willing to issue a license to an offshore brand.