How is that remotely legal?
It's legal the same way firing someone for no reason is legal. This ain't fantasyland. If the employee makes a fuss, then the employer's first argument is that the hours weren't "qualifying"-- ie, the employee's work product wasn't "up to snuff". Employees that rock the boat get replaced by new hires fresh out of accounting school. I've seen lots of people walk out on these jobs, only to see them replaced within a week.
In 2005, the last time I worked for a big firm, the new auditors only got 38K to start. The required travel and hours were insane. They took their computers to the audit location and worked all day, then went back to their hotel rooms and worked all night. They were basically slaves.
Once the auditors got their CPA license, they often quit, unless they got a pay raise.
Oh, and it depends on the requirements for the state-- tax hours do count towards the license in CA, but if you get your CPA license with only tax hours, it's restricted somehow-- you can't do audit work. Not sure exactly how it works, and it's been years since I've checked.