The appointment exactly complies with the letter of the law: https://www.gsa.gov/governmentwide-initiatives/presidential-transition/legislative-overview/the-federal-vacancies-reform-act-of-1998
This is a very good article on the subject as well.
Interestingly, the strongest case for this in recent years comes from none other than U.S. Supreme Court Justice Clarence Thomas, in his concurring opinion in the infamous National Labor Relations Board v. SW General, Inc. case in 2017. Thomas took the Obama administration to task and suggested that the provision of the Federal Vacancies Reform Act (FVRA) allowing appointees to serve in "acting" roles was unconstitutional. Here's his money quote:
"We cannot cast aside the separation of powers and the Appointments Clause’s important check on executive power for the sake of administrative convenience or efficiency. That the Senate voluntarily relinquished its advice-and-consent power in the FVRA does not make this end-run around the Appointments Clause constitutional."
The good news is that Maryland's lawsuit will probably take longer to resolve than Whitaker can even stay in office.
The better news is that Maryland's claim that Rod Rosenstein must become the acting AG will not stand up to any Constitutional scrutiny. The Deputy AG position was never established by Congress, and it exists only as an executive branch creation through an internal DOJ memorandum dating back to 1950. All Congress did after 1950 was pass a law requiring any Deputy AG appointee -- IF the President wanted to name one -- to be confirmed by the Senate.
Also ... The succession order for the U.S. Attorney General in the event of a vacancy is established through Executive Order, not Federal statute. President Trump is probably having his "acting AG" draft a new Executive Order as we speak -- cutting the Deputy AG out of the succession line completely.
Maryland cannot order the President of the United States to put a specific person in that role. A U.S. state has no legal standing to make such a demand. The only thing they CAN do is challenge the authority of the existing "acting" AG.
Congress passing a law specifying how the Executive acts is the ultimate Constitutional advice and consent.
And note that Pelosi and Schumer both voted for the Vacancies Act.