Was that not Fallout 4 rather than The Witcher 3, or did it happen more than once? Either way, they clearly sold enough keys during the kerfuffle that the only way they could have got them was buying them wholesale off one or more of their competitors who'd managed to get hold of some, and then it makes sense that they'd want to keep it quiet who it was so the publisher wouldn't penalise them.

It's basically the same as an independent game shop buying a box of games from GameStop (or your regional equivalent) when their normal wholesaler has issues so their regulars continue being regulars. As far as everyone's concerned at the end, a retail key was sold to a retailer and ended up in the hands of a customer, and no one in the supply chain got scammed.