Sometimes stolen, but yes, it's mostly games bought in other regions where price adjustment makes them vastly cheaper. They are still making money, or technically already have off of each of these copies, but vastly less than they are charging, while the grey market sellers profit by making that price gap ever so slightly smaller.

It's really screwing them. If the consumer is willing to pay $25 but not the $45 they'd find on GMG or something, buying through the grey market means maybe only $20, 15, even 10 of that money spent, is going to the pub/dev. The obvious solution is to lower the price (for a digital good that has literally zero value and cannot be owned) so people are more comfortable paying for it, but if that's done, what pricing do the copies in poorer regions see? You'd have to match the price, as scaling it down equally without completely region-locking all keys, would just make people go back to grey markets for even cheaper copies.

I've bought from GMG, but never a grey market, even though it's cheaper and I don't have much to spend. I'd rather wait to get it cheaper in some official capacity, eliminating as much risk as possible, as buying a literally worthless product that's non-transferable, is already a risk enough as it is. Meanwhile, I've seen tons of big streamers and YouTubers shill for G2A, Kinguin, CDKEYS, etc, sometimes paid, sometimes not.

One thing I'd like to mention, is resale/trading of bundle keys. That kind of thing is supposedly disallowed, but I feel that's a bit of an odd stance vs any physical product in the real world. There are some jackasses who buy thousands of bundles through bots and stuff, and then resell the keys. I've seen tons of sites built entirely around selling said games at near full price, often numerous times more than the bundle cost. That's clear abuse, but there's also a ton of people that just end up with more games than more duplicate games than they could handle, because of how many times titles are re-bundled. G2A and Kinguin operate like eBay, and not all but some of the smaller users on there are just selling their duplicate games via the systems on offer because it's continent.

There are so many layers, and almost all of it is insanely difficult to prove unless you come up with some sort of tracked key system. There are thieves, there are those abusing everything they can, there are largely innocent users, but places like G2A/Kinguin make damn sure they are directly responsible for none of it, by making it appear as if everything that occurs is out of their control. And regardless, unless the halt of piracy is combined with an intense region-locking plan, sales on grey markets will rise, and more money will be funneled away from pubs/devs, just like the physical console market with GameStop, eBay, Walmart, Best Buy, Amazon, etc. And when you realize they do that, and are doing it with real products that have real world value after use, it kind-of makes the trading and sale of licenses to borrow digital games online seem like child's play...