Is a professor at MIT teaching cyber security exploit development guilty of the same crime?

What about a consultant teaching how to use a particular tool or how to look for a particular family of exploits? (Potentially legally dodgy, depending on the client, but probably ok in a lot of grey areas)

What about a consultant which performs a passive audit of a target for a 3rd party? (Starting to get pretty dodgy, but probably depends both on the 3rd party and the target and the nature of the audit)

It's... probably not so cut-and-dry. Though I agree that it doesn't sound like a get-out-of-jail-free card.