As far as I can tell, it's legal, at least until it causes them a problem. Then it might not be.
What Lorem Picsum do around the back is their problem, not yours. You're using their service, is all.
That's too general a question to answer.
As for best practice, I'll consider a similar situation: the NTP Pool Service. They run a volunteer global network ...