Its their game, and believe me they most certainly can touch you. Yes, i'm aware of all this "time invested" stuff, but I assure you that if a player is discovered to be using an account purchased or acquired in any way from another player then that account will be banned - turning around and saying "aha, but I paid for time invested" to the Blizzard GM's won't make a scrap of difference, the fact remains you will still be using an account which has been acquired from another person.
While simple wording can steer you clear of legal action, it will not save the recipient/buyer of the account when it comes to the repurcussions of breaking the Terms of Usage set out by Blizzard. These Terms of Usage specifically state that Blizzard do not recognise the transfer of accounts between individuals and any unauthorized transfer of accounts through any means will be considered a breach of the agreement and may result in your account being terminated.
Yes, a lot of people do it, yes, a lot get away with it, and unless you do something really stupid then you'll most likely get away with it too - i'm just tired of people who seem to think the "ingenius" use of stating they are buying the time invested will give them immunity from any repercussions whatsoever.