Sure, the “home-made” option is hard to regulate in any field. You also can’t stop people from using hone remedies no matter how unethical they are. So you can take it and use it with little recourse.
But I was thinking more at FAANG for example. They could be required to hire “certified ethical” engineers at least on sensitive projects at first. This means that even if the code is out there no coder would implement it in the company’s solution without risking losing the “certification” and the job. Anyone working for the Hacking Team (those guys selling exploits to oppressive governments) should be more or less unhireable especially if all code in a company’s portfolio should be traceable to a specific engineer.
The principle is already in place for other fields. Journalism being the closest probably. It could be made more effective if needed. It’s obvious that something is needed in this direction.