For me both are equally possible. The past tense assumes that the illegality could have been pronounced outside the present conversation, while the present includes current participants to the conversation.

In light of the above, illegality being normally pronounced by some external authority, the past tense could be a better fit. But for other judgements (“immoral”, “malsain”, “dangereux”) the present could make more sense.

For me, the first one “Qui a dit que c’était illégal”, below the tense, is more indirect and maybe implies that the locutor knows that it’s a risky action and pretend to not knowing it (among others things, but it’s more expressive), whereas the second one “Qui dit que c’est illégal” is maybe more platonic and implies that the speaker has a strong assuption that it’s legal. But I think it’s a bit personal and the two are corrects.