Ugh. It does look like the wording gives some room though?

As in, it requires “preparing the commission of an offense”. Does acquiring the tool for other uses like learning or professional training help?

Or even better, shouldn’t lack of proof that the user had malicious intent be enough?

Police can always fabricate intent (this is not specific to Germany - they can just say you told them you were going to hack someone, or your actions or body language obviously showed it) and then in practice it's up to you to show an alternative interpretation of facts. If you're studying computer security, that might get you off - but who better than a computer security student to do actual hacking?