>At what point do they become subject to Illinois law?

When they sell to someone in Illinois, although there is probably some bullshit case law out there that says the website owner has to take basic steps to block Illinois users to avoid all IL jurisdiction.

>And can Illinois prosecute someone for doing something that is legal in California while they are in California?

No.