What is legal is also complicated. They are obligated to provide a reasonable degree of services and what is reasonable is a broad term with a lot of possible variance. If there were no working online system and always a 50-minute wait on the phone, you would likely have a decent argument that DVC is not doing its job. However, if the phone problem is not always bad, or if there is an excuse, like all those employees providing such services are s working from home now because of covid and thus services may be worse than usual as a result, then your claim of failure to do what is reasonable becomes weaker.
And yes, they are allowed to keep money from the three sources as profit. Though annual dues must be set up to cover only actual "costs," that does not necessarily rule out any profit. The $1 DVC Reservation Component Fee is just a set fee and thus its "cost" is $1 per member. Breakage income is expressly allowed by the POS. The 12.5% annual management fee is the specified "cost" for providing management services in a contract that each association has with DVCM, the management company. In essence, those are set "costs" regardless of whether some profit might be realized from them. It is the same problem we have with DVC getting most of its services from other Disney entities. For example, it pays the Disney Parks and Resort entity for transportation. What that entity charges DVC for the service is a "cost" in the annual DVC budget but it is possible that the Parks and Resort entity is charging more than what would be its own incurred costs.
