If I'm not mistaken the developers are only really paying a license to use them? Most comments over the years indicate they "should" be sent back once the devs are finished with them (and I guess destroyed eventually?) It becomes a grey area when the developer goes into liquidation (which happens quite a lot) and all their assets are sold off at auction to pay off debts. I believe that if you buy them from an auction you are legally allowed to own them - or it's too much in legal fees to bother chasing up. It's that murky area in the middle - after x amount of time neither the dev or the company that produced them (Nintendo, Sega, Sony, etc) actually have any use for them and they seem to slowly trickle out onto eBay and forum marketplaces. Probably not legal but the only real trouble I've seen with devkits is people accessing games pre-release and sharing them. So far it seems that It's not the devkit that gets you into trouble, it's what you do with it that might. A friend of mine worked on some Gamecube titles for Vivendi way back when and they had at least 3-4 - for one game. It all depends on how many testers a game needed... so it's impossible to really know precisely unless you know someone in Nintendo Japan who kept logs (good luck!) - at best you could estimate how many dev studios there were and maybe draw up a very rough estimate.
I'm not sure, but I think they were sold - some time ago, I got a DDH and some NR readers from the same source, and the DDH had that "Confidential Property of Nintendo" sticker on it, but the NR readers didn't.
Found this interesting little tidbit on the assembler games YouTube channel. Apparently the packaging says that they are on loan from Nintendo. Not sure if this was a case by case thing or if they were all like that. If that’s the case, I’m wondering how so many got out in the wild.