These are separate issues and it’s a very complex set of issues. Reverse engineering is generally “okay” as long as you aren’t directly copying code, because you’ll run afoul of copyright laws. That doesn’t grant them the rights to access anyone else’s computer systems without authorization.

Tools that can be used maliciously are generally allowed because they have legitimate uses, using them to gain access or otherwise harm a computer system or network without authorization is criminal. You keep mentioning “suing” but this is not a civil issue, violating the CFAA is a crime.

Aaron Swartz got supremely fucked for writing a script that downloaded files he legally could access but technically was unauthorized because he accessed them in a way the corporation didn’t like.