In many cases, these are minors. A criminal record will be a black cloud over their future educational and employment opportunities - and could negatively effect their life course. Perhaps they fully understand the consequences of their actions? Perhaps schools and law enforcement have the capacity to be nuanced in their actions? Based on my work on these issues, I question both premises.

Depends on the type of hacking. A lot of hacking doesn't fall under any specific law.

USC § 2511 says that for intercepting traffic on a wifi network without permission, you can get up to five years in prison. [https://www.law.cornell.edu/uscode/text/18/2511]