I don't have references, other than what I've read in forums, but I believe

• Canon do not licence/provide data on their EF/EF-S mounts to anyone
• Sigma do not purchase licences (they reverse engineer all mounts)
• Tamron/Tokina licence Nikon, not sure about others (obviously not Canon)

There is nothing illegal about reverse engineering, per se. In some cases it might be illegal to replicate, for example if there was a patent in place, but there is no patent that blocks the 3rd party manufacturers making compatible lenses. There are patents on various lens (optics) designs, which is why you don't see them making exact copies of Canon lenses.

Compatibility problems are always possible when you reverse engineer an interface. This can be by design, e.g. if Canon were to put a few hidden messages into their protocol, which they would only start using after some years. Or it could just be that Canon's definition of the protocol allows for unexpected message variations, which, without documentation or an example of the variation, it would be impossible to design a compatible lens. I'm not sure there's much point speculating on exactly how/why, given Canon are very tight-lipped about the protocol and the manufacturers who reverse engineer it are hardly going to share their hard work (for competitors to take advantage of).

An example of this kind of thing might be ASCII and UTF-8. Any text in ASCII encoding will be equally compatible with UTF-8, but a UTF-8 string can also encode many more characters than ASCII. Now this was done for backwards compatibility, and was well documented. If you had never seen a UTF-8 string, you may not guess that certain ASCII bytes (over 127) indicate the following byte(s) are actually a continued encoding of a single character.