My old company has its dev team in Shanghai, we used multiple VPNs: openvpn and a Cisco vpn; we setted them on company's router.Normally it's ok except some special days like every year's session.
Some provider (like NTT) also offer MPLS lines. The company I work for rents one which goes directly to Europe. Those are also not affected by the firewall and in general much faster than normal VPN setups.
Cisco is known to support "lawful intercept" protocols in their routers (in fact they were the ones to propose it to IETF a decade ago), so I wonder if they find it ok to not censor your connection because they can already spy on it. This way at least they can check if it's really for "work". Other VPNs who they know aren't used for work, get blocked.
My impression is that they don't care too much about individuals evading the firewall. It's a tool for broad social control, which doesn't need to be airtight to accomplish its goals. As long as it's inconvenient to browse to blocked sites, it redirects conversational topics to safer areas, and a small number of individuals bypassing it doesn't affect that too much.
Most Chinese give a f. if something is illegal or not.
Look at he xray machines that you are supposed to put your luggage in before you enter the subway. Many Chinese just walk by and ignore the complaining security girls.
VPNs? Well, companies need internet and EVERY company in China used them. It is so stupid and insane at the same time.
China is not a state ruled by law (, as some believe it is ruled by theft, or a kleptocracy). So it is not well defined whether this incident is illegal, and usually for controversial issues, argument for or against its legal status is not helpful at all.