What do you mean “companies steal and sell them”. How? Like they are hacking into the email accounts of streamers and stealing and selling the key before the streamer can activate it?

Or they are stealing them from the developer directly somehow?

I don’t see how this would be feasible…

More likely that the streamer or reviewer receiving the free key is selling it on these marketplaces.

If these streamers aren’t being contracted, then it is basically the same as a gift. Selling the key is still perhaps morally dubious if there was an expectation of promotion, but that’s as far as it goes.