ELI5 do countries like the US hire private military companies to take part in war?

Yes, the United States an a great number of other nations including many in the EU do hire PMCs. Where it gets dicey is how you define "war".

PMCs as a rule are not permitted to take part in offensive operations because of treaties that fell in after Executive Outcomes became the reason private security contractors couldn't have nice things. Anyone that tells you PMCs are regularly partaking in such operations are lying and have no idea what they're talking about. What they are allowed to do is security, which granted, is a large umbrella. Security contractors are allowed to do things like convoy escort, or static site protection. They're not allowed to go out and arrest or kill someone.

If so why is this even legal?

Because for as greasy as it is, the industry has legitimacy. There are organizations and agencies like the State Department who ostensibly do business in less than savory countries, like Iraq. More often than not however, they don't have the guns (so to speak) to protect themselves in these situations and the military more often than not is unable to offer protective services because of legal or resource constraints. In theory, they fill an important gap.

There are also private businesses that do business in not so nice places who don't want to rely on local police or security because they're all bent. Basically anyone needing security in Latin America, Eastern Europe, Southeast Asia (where radical Islamics can be a real problem), or Africa all hire through companies like AIG/NYA (Yes, the insurance company; they have a large but very quiet KRE division and subcontract with NYA London).

There are always people that fuck things up like Blackwater, Executive Outcomes, Spear LLC. and all them. For the most part though, PMCs go about their business very quietly and without incident and they serve an important role in a few interstitial spaces on the world stage.