Since cannabis is still federally illegal, how do states legalize it? Couldn't the federal government still enforce their laws?
US States cannot and do not claim to repeal the federal laws against cannabis. What they can do is repeal or modify their own laws. Historically the vast majority of prosecutions in the US have been under state, not federal laws.
Nothing requires a state to enforce Federal law.
States can also forbid their police and other employees and officials from cooperating in cannabis cases, passing information to federal law enforcement, or holding accused persons when no Federal warrant is yet available. State support and personnel has often been important to federal investigations.
All of this can make it much harder for the FBI and other federal agencies to pursue cannabis cases in states that have "legalized" cannabis.
Moreover, as a matter of policy, not law, the Justice Department has, in general, declined to pursue cannabis cases in such states. This policy could be changed at any time.