None of this is 'legal'. There is no law that says a mask is required anywhere. Businesses have been assigned by health departments to enforce health guidelines at the risk of losing a license to operate if they don't enforce those guidelines. So Mighty Fine Catch is legally perfectly within his/her rights to not wear a mask but his employers could get fined/punished by the responsible department of health.

And, of course, the Facebook and Twitter Karens will destroy his life forever ... so there is that.