It's a civil offense, but that's different from it being legal. It just means that it's up to the company itself to sue you to collect any damages, and government enforcement bodies aren't going to touch it.

The issue most ToU violations have with enforcement is that it's hard to show damages. If you just accessed their service with a fake name or downloaded some data for personal use, you haven't really harmed the company. So what are they gonna do, spend $10M to sue you for $0? So they just handle it internally by banning your account and discontinuing your use of the service.

But if, say, you did a DDoS attack that caused an outage costing them $100M, or you did large-scale scraping to set up a competitor that puts them out of business, and they can identify you, they absolutely will come after you in court for that money. The economics is different: now the damages they show is much more than the cost of litigating the case.