2. What he did was in no way illegal. He did not cheat the system. The IRS would have come down on him with a hammer already, and they haven't managed to figure out how to do it for the last decade.
Part of my work is in financial investigations. The finances of large, multi-entity organizations are expensive to create, difficult to parse, and require extensive periods of time of trained, expensive staff to understand.
Assuming that 'things would have been caught' flies in the face of the fact that they almost never are. Accounting rules change frequently, software systems for logging information is changed, and records are lost. Emails have to be read in tandem with entries to understand the intentions.
Even in cases where we have confessions that someone has embezzled money, we often need to spend multiple weeks tracking down records to isolate when/where/how it occurred.
Even during audits, requests for records can be baked. 'Random' samples of given entries can just exclude the questionable ones.
I've appeared in front of federal tax courts in my practice, the game isn't fair - don't base your reasoning on the idea that it must be.
2. It very well may have been illegal, as mentioned in the top level post. The purchase price was the legal value, but using an IRA as a vehicle to invest in your own company appears be prohibited by IRA regulations. At the time, it was a purchase <$2000, and may not have been reviewed. If paypal was someone else's company, there would be no legal issue.