Can confirm paid by pull request. Developers like this arrangement too. It's not a black market or illegal to hire contractors to build stuff for you. Not everyone wants to be tired down to a single employer.
Discussion
The point being that you might be their only employer, in which case German law forbids it because they're tied down, but not covered by employee protections.
It would be clear if we had a larger market for paid-by-PR and they were pulling PRs from different projects. Then it's contracting. Perhaps we have that and they're pulling PRs from many different employers.