1: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... [de]
They really couldn't. BVerfG (Germany's constitutional court) has clearly said that dual use tools have a presumption of not being tools to break the law. It's been very clear that mens rea matters. And that a narrow reading of the law is the only constitutional reading.
The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read.
It's still a problematic law (together with §202a/b) because it doesn't clearly carve out space for grey-hat activities (white-hat attacks with authorization really don't fall under it even with creative reading).
On the upside, Germany is considering fixing that. On the downside, it moves with the speed of classic German bureaucracy and is being "discussed" since 2024.
Back in the days of "smart contracts" and "DAOS" this was something many well-meaning technical people struggeled with. Humans and their societies are flexible and therefore laws must be flexible as well (to a certain degree before it becomes damaging).
It's also why a lawyer/expert is usually recommended when engaged with legal matters: We as layman lack all the context around seemingly "simple" concepts, procedures and definitions. You can learn all of that or hire a professional.
In that way, I don't really think the government need to design laws to have loop holes in them. With enough political pressure they can get the judges to make any decision they like.
I'm not sure white-hat hacking is broadly compatible with German culture. Keep in mind that going bankrupt in Germany permanently closes off lots of avenues, from future lending to whether you can be in senior management at a public company.