Most products can be used for illegal purposes, so just selling something that is used for illegal activities can't incur such liability in general. There are exceptions, of course. If a product is clearly made for illegal activities and has little or no legal use, the supplier is likely to be liable. If a supplier produces something and markets it for illegal purposes, that's likely illegal.
In this case, penetration testing software has a clear legal use: security professionals using the software to test computer system security with permission from the system owner. Computer systems are complicated, and difficult to secure, so in many cases it's necessary to test to see if they're immune to normal hacking tools. Therefore, writing these tools and selling them to computer security people serves an important legal purpose.