Codes to gain in-game event Pokemon are fine by me. I've missed tons of event Pokemon usually because I miss the event window due to having little time to play.
Anything else shouldn't be allowed, even the IV modifiers. Unless of course you have no intention of playing online & competitively.
GF have made EV's considerably easier to manage this gen so I don't see the need to mod those besides laziness. I never normally breed for IV's because for the most part I avoid online play unless battling a friend. Decided to give it a shot this gen though. I've used EV and IV modifiers before in previous gens, but I (until X&Y) have never played online and I wouldn't with a team I had modified and didn't 'earn' as such.
If modifying a pokemon's IV's to get 31 across the board is acceptable, then GF may as well just set all wild pokemon to start with the highest IV's possible and hell why not make all the starting moves the top egg moves while they're at it! Wait! lets reduce shiny rates to 1 in 10 too!!
I was lucky enough to receive a 4IV Modest Feebas with 3 egg moves over wonder-trade yesterday, only thing it needs is Special Attack. So I've been breeding it today in an attempt to get 5 perfect IV's. Every 'Outstanding' Feebas I've had so far has been missing Defence or Special attack. After just one day of breeding feebas after feebas, I can understand how irritating it must be for the people able or willing to invest the time to get these perfect IV's and egg moves, just to have people copy a code into an action replay and do all the work in a matter of seconds.
I genuinely wish there were an easier or at least less random way of getting top IV's but using codes to modify them isn't it. RNG's suck, I've had my fair share of being screwed over by RNGs in many a game. Rolling 1/100 or even worse 99/100 in an MMO just to have another player roll 100/100 XD. It's infuriating at times, but does that make hacking or illegally modifying a game a reasonable alternative?
On a side note, not sure anything can/should be considered 'legitimate' if it's hacked in...just my view.