Of course it's legal to buy them, go to GoDaddy or any registrar and reg one. However, keeping them is another thing.
I was looking into this last year and found there are a lot of UDRP cases on these and they almost always find in favor of the athlete and award the athlete the domain. I spent hours researching and found it really isn't worth dealing with. If someone complains or mentions Trademark violation (True or Not) some marketplaces will not list the name.
It can be a headache if the athlete wants to come after you for violating a Trademark (both registered and unregistered) as well as Copyright infringement. Right or wrong, they almost always have top-notch lawyers and are willing to spend what it takes to get the name and you in trouble.
If you have a few hours, do the research and it begins to become clear that they really aren't worth the PITA.