Why is this legal

The compiler cannot know what input you will be giving at runtime, so it cannot say that you will be doing something illegal. If the input fits in the array, then it's legal.

Prior C++20:

The behaviour of the program is undefined. Never do this.

Since C++20:

The input will be truncated to fit into the array, so the array will contain the string "co".

It is allowed because the memory management is left to the programmer. In this case the error occurs at run-time and it's impossible for the compiler to spot it at compile time.

What you are getting here is an undefined behavior, where the program can crash, can go on smoothly, or present some odd behavior in the future.

Most likely here you are overflowing the allocated memory by one byte which will be stored in the first byte of the subsequent declared variable, or in other addresses which may or may not be already filled with relevant information.

You eventually may experience an abort of the execution if - for example - some read-only memory area is overwritten, or if you point your Instruction Pointer to some invalid area (again, by overwriting its value in memory)