The fact that what is legal? That a company can revoke a passport issued by itself? Seems pretty reasonable.
Maybe people could disagree on specific examples, but the principle seems fine. US passports say in them that they can be revoked for a variety of reasons.