If you're talking steroids, most are bought online. The raw materials to make the drugs almost all come from China. "Entrepreneurs" in various countries will buy these materials and mix them up in their basement into injectable oils and pills, which are then sold online. All transactions are made with cryptocurrency. Almost no legal risk to buy, feds go after suppliers rather than users. Some steroids are easier to hide from drug tests than others. Athletes getting popped usually means that their supplier messed up and mixed in trace amounts of a different steroid that is easily detected.
There are steroids made by actual pharmaceutical companies which are prescribed by doctors. I don't know if there are a ton of doctors risking their medical license for athletes.
GNC actually was straight up selling steroids over the counter in the early 2000's as workout enhancers. There were marketed as "prohormones" and they were basically just steroids with less testing and worse side effects. Some technicality or faulty regulation made them legal to sell. I think laws banning them weren't passed until 2014.
GNC will sell anything that the FDA hasn't sniffed out yet. Most of their stuff is expensive garbage marketed to look like steroids, but yeah apparently back then it wasn't just a ripoff, there were legitimately dangerous substances on their shelves.
