You're correct. There's no issue to sell under a GPL license. The commercial section of WordPress.org are all GPL providers, but many of the largest commercial theme providers are listed there.
ThemeForest actually uses a split license, wherein the templates within the theme are GPL, but the CSS, images, or non-WordPress dependent things in the theme are "protected" under a different license.
GPL has essentially turned into a non-issue for commercial WordPress entities that have gone that route. This doesn't mean they don't get copied and stolen, because it happens all the time - just like non GPL products. But the business models are well beyond selling a template and forgetting about it. Support, updates, reputation, code quality, and other factors are a driving force as to why someone would buy a theme from the actual provider rather than a "legally" ripped version for a fraction of the price.