Again: fraud is de facto legal.
It is ubiquitous in every part of the business world, both internal and consumer-facing.
A more useful construct is that civil offenses are only a problem if someone is aware of, motivated, and able to afford to sue you over it. Businesses do a lot of arguably illegal things that are not likely to lead to an actual lawsuit.
De facto is the opposite of de jure, so no, non-enforcement doesn't make it legal