First it's legal if you use a evaluation version of any windows system (server too).
Second you (bitnami) is offering virtual machines, so it doesn't matter if the vm is based on a windows or linux system.
By the way.... Metasploitable3 isn't for linux, Metasploitable2 was it, but v2 is a old system and no longer suitable for penetration-testing!
The fact is Metasploitable3 is using just a evaluation version (automatic download from internet, it's standard config) by creating this vm.
But it's possible, if you have the iso of a evaluation version you can use the folder - whit the iso - local.
There are windows server evaluation versions for 180 days!
Another reason why is legal:
Microsoft is offer windows client vm's (expires after 90 days) too:
My english isn't so good to explain you how it works.
Closing the thread is evidence of high intelligence!