I mean, people can get high Attack IVs on legitimate soft resets. My very first flawless shiny was an Adamant Deerling 31's across the board, even in Special Attack, which it didn't need. Another Shiny I got was a Shieldon with the same set of IVs, while it was a Careful Nature, so it didn't need the 31 in Sp.A, but it still got it.
You shouldn't underestimate that there are people out there that know how to RNG, but knows very little about what IV spreads and such are actually good (I would mention some examples by username, but they probably wouldn't appreciate being mentioned as an examples for that).
IVs are rarely, if ever a good factor to judging whether or not something is Legitimate, Legal or Hacked, now that RNG abuse is a thing for almost every relevant method of obtaining Pokemon. The factor it pays into the judgement of legality is looking at whether the IV spread is possible or not. Sure, it's easier to look at a 31/31/31/31/31/31 Nihileho from Wondertrade and say it's hacked, but really, I wouldn't trade a Nihilego with IV spreads like 31/0/30/31/31/31 or 31/17/31/31/9/22 or even 31/31/18/31/2/16 either, if it was from Wondertrade. You never know if a previous owner for example used it as a test subject for messing around with their hacking tool.