It’s legit because even the server-broadcasted format.turbo_stream use the javascript magic that adding a turbo_stream inside a turbo_frame does.
Both end up having a <turbo-stream><template></template></turbo-stream> element being added to the page, getting picked up by the JavaScript magic (a MutationObserver) that then either appends or replaces or updates elements on the page with the same id or classes.
So it’s legit, and sometimes it allows you to package both the updated HTML inside the turbo_frame itself and updating a different part of the page (e.g. adding a flash message somewhere else on the page) in the same response.