Not really, no. Don't mix up the terms "legit" and "legal".
"Legit" means that a Pokémon was 100% obtained without the use of hacks.
"Legal" means that all of the stats, moves, and abilities of Pokémon are "possible", despite having potentially been hacked.
As a matter of fact,
Alexp77777, I'm inclined to believe that it's a hacked Pokémon.
If someone is knowledgeable enough to perform RNG abuse, they most likely wouldn't go for perfect 6 IVs.
They'd instead aim for 0 Atk IVs for a Pokémon that runs a special nature like Timid in this case.
Someone that just hacks a Pokémon really quick wouldn't pay attention to this little detail.
Please refrain from giving hasty answers to hack checks like this. The matter is a lot more complicated than you might think.
Please only reply if you have a definite answer that is based on evidence and solid arguments.