These projects can add their token on coinmarketcap as long as it qualified to the listing criteria of coinmarketcap. These tokens are doing their best to be listed and I believe that there are shitcoins that managed to enter the listing site. Those shitcoins after rugged or having no problems at all are still listed there but I've seen some coins there that has red flag or warning from coinmarketcap that a certain token had experienced such problems such as being rugged or what kind of status does the token has. Though it's always not a good thing that we based the legitimacy of a project by just being listed on CMC, as well as other trading platform such as binance.