Yes, legitimacy comes from people, but any dictatorship or authoritarian government does require some amount of support from its people otherwise it will not last long (the number can be significantly smaller than 50%, but usually quite substantial). There are a lot of people in Syria who sincerely support the government (you can call them brainwashed by propaganda, but it does not change the fact) and any state has a sufficient amount of people who are unhappy about its government and would like to change it as soon as possible.

Is the current US government a legitimate one? Can Russia start covert support of the BLM protests by supplying means to confront police forces and embedding intelligence officers into the movement to help with coordination, while being justified in your eyes? What gives the US right to decide that Syrian government is not a legitimate one, thus creating a justification for such crude interventions, which only destabilize situation further?

The point is: one internationally recognized government can do deals with another internationally recognized government (with some restrictions, such as non-proliferation agreements, UN sanctions and others) and such deals are not equivalent to military support of foreign non-state actors and active attempts to overthrow "oppressive" governments (list of which by a very strange coincidence does not include Saudis and similar countries).