Piracy

They'll still get sold because the reseller sometimes doesn't bother to unlist it. Devs can deactivate keys, but some are hesitant to do it because if someone buys from the shady reseller site thinking it's legit, if the key gets deactivated after they buy and redeem the key, the game is removed from their account with (usually) no way to get a refund. Ends up as bad reputation for the dev even though it's not their fault.