What do you mean "companies steal and sell them". How? Like they are hacking into the email accounts of streamers and stealing and selling the key before the streamer can activate it?

Or they are stealing them from the developer directly somehow?

I don't see how this would be feasible...

More likely that the streamer or reviewer receiving the free key is selling it on these marketplaces.