- Only capable of breaking copy protection

- Have minimal commercial utility other than to break copy protection

- Are advertised as being able to break copy protection

If you sold someone an aux cord with the marketing slogan "Copy music off Spotify and stop paying for your subscription", that'd violate 1201(a)(2) because of that third prong[0]. There's also plenty of copy protection circumvention tools that DON'T trip 1201(a)(2) because they aren't marketed as such and have noninfringing uses. For example, Google Chrome. You can use it to bypass right-click blockers because it lets you open Devtools without right-clicking. However, browsers have loads of commercial utility outside of this, and they don't specifically advertise their ability to get around annoying right-click scripts, so they're legal.

We don't normally contemplate this sort of thing because most DRM is specifically designed to be both obvious and separable from other permissible behavior. You cannot accidentally write a DVD decryptor that doesn't trip 1201(a)(2). This has led to people mistakenly assuming that the DMCA requires encryption to be involved or something for a copy protection circumvention tool to be illegal.

[0] I've actually seen this happen. There was someone selling VGA cables marketed as a way to copy Netflix.