A ton of them apparently come from regional pricing, or from keys purchased by businesses. Windows offers volume licensing where you can buy bulk keys at a steep discount, basically. The business might not use all of them, and then they turn around and resell them. That’s technically against the terms of the license, but afaik Microsoft has never bothered to enforce that.

I’ve also heard people will take the Windows keys off of older OEM towers and resell them. I have no idea how true that is, but it would also be against their terms.

It’s not exactly likely, but Microsoft could probably just deactivate all of those keys at once if they decided to.