Legality aside because I'm sure there's always going to be some random law that they will use (or twist) to fight this... With 3DS I remember there was a community provided cloud cracking service. I'm guessing it was either some comically weak algorithm or they found some vulnerability they were able to exploit.

But even then that's not really a good comparison because if there was some master key (I don't know the specifics) it is still physically on your 3DS and they weren't sending them around (or worse, hosting it on a store).

The situation sucks but I understand it from Valve's point of view. It's not about whether they think it is okay or not, it's about them being concerned about liability from Nintendo who are well known for protecting their IP.