It’s likely legal since you’re placing a deposit without order, the name itself suggests that it’s not tied to an item. It basically works like them holding a store credit for you. I had a DEPWO for months with the Tyler drop then eventually just applied it to something else. Not that I agree with what they’re doing, FWIW. But I know the deal when I give them my money and I can choose to no longer do business with them if I don’t like their new schemes.
If you ordered an actual item that was cancelled a while later, I assume their defense is that they’re making you whole by refunding. There are people who have had a deposit on the Tesla Roadster since 2017 with no updates
But, of course you can sue anyone for anything.