The judge ruled it was "fair use" because the VM's are used for security testing. The company behind this also requires you to register before they allow you to use the VM.