https://iclg.com/practice-areas/cybersecurity-laws-and-regul...
I'm German... our politicians, at least most of them are a bunch of pathologically technologically incompetent buffoons. A lot of that was masked during the Merkel era because she herself was a literal nuclear physics doctorate, but now that she's gone, it's painfully obvious what's going on.
It's similar to how weapons designed to be used against people are regulated differently from tools that merely happen to be usable as weapons.
In the concrete case of sharing tools to explore the attack surface of KakaoTalk, this is not a crime under §202c StGB as long as you do not intend them to be used to hack accounts you do not own.
Good luck to the prosecution trying to prove that you did intend to hack other people's accounts when you can point to this blog post where the author demonstrates hacking their own account and reports the vulnerability to get it fixed.
I think people who get convicted of one of the "preparation to commit a crime" crimes mostly:
1. fail to come up with any alternative explanation for their behavior
2. put their plans in writing or told someone about their intentions
Theoretically.
Unfortunately, judges who are actually fit in IT topics are rare, especially in the criminal courts. They tend to rather believe what the prosecutor tells them. I'm just happy we don't have US-style juries because that would be even worse given our collective love as a society for faxes and writing information on highly processed dead trees (i.e. paper).