You would be correct. By the letter of the law, it's illegal for any out of state seller to sell an auto to you. As a matter of fact even if they ask for LEO or military creds its still illegal due to how the federal statute is phrase (that is, they can only be sold within the confines of a military contract).
The big giant however is, it's only illegal for the seller. You're fine, no matter what you do.
With that said, there are many online sellers willing to illegally sell out of state to anyone with the money. Some are even makers on this forum. They just get away with it because the feds just don't freakin' care. They know it's a dumb law and it's nearly impossible to enforce because mail is private. Even if they do get caught, it's just a monetary fine.