Legit just refers to a Pokemon that is obtained officially (caught in the wild, bred, event, etc.) and is not hacked or cloned. So yes, a mythical scanned from a QR code is legit. Furthermore, the only way to get Megearna is through a QR code -- so any Magearna not gotten through that method isn't legit.