Can someone explain how this is even remotely legitimate?
The US routinely does this and views extra-territoriality as perfectly normal as long as it does it. Examples are sanctions applied to HSBC for money-laundering for Iran and the ongoing investigation of Glencore. I think the law is called the Foreign Corrupt Practices Act and is the basis for Trump's reneging on the Iran deal: lots of companies are so scared of this that they're willingly dropping ties with Iran.
However, when the boot is on the other foot it goes apopletic: heaven forfend that any other country go after a US company! Oh, and dealing, including taking bribes, with murderous, autocratic regimes is okay if the president says so. So, we can sell whatever we want to Saudi Arabia…