I guess this only applies if they pentest a belgian institution? Otherwise that would be prosecute right after the leave the country
Of course you might still be prosecuted outside Belgium, e.g. if you pentest an Oracle setup in Belgium, and Oracle takes issue and files charges against you in the US. But that is less likely to happen or succeed.