I do not see anything criminal at all in writing some malware or exploits. _Applying_ them to a system, where they might cause damage however, that is a completely different matter.
You don't go after the blacksmith or manufacturer of kitchen knifes or guns either. You go after the one using them for the wrong purpose.
MaaS (malware-as-a-product) is certainly criminal. There’s no legitimate purpose in writing control servers or admin panels for DDOS or ransomware.
But I'm not really interested in drawing an actual clear line. I'm worried especially what will happen if a local police officer or court judge takes action based on their personal assessment of a cybercrime. And now, with this law, international action. Right now often DNS is sabotaged, usually on a way larger scale than necessary, to achieve a court order. Inconveniencing everyone, often right up to gTLDs.
Usually such a court order then doesn't work because the fact that a court case exists (and the time these things take) serves as ample warning for the malware authors plus you can use encryption to hide the command and control servers beyond the reach of even sabotaging DNS. And even that is assuming the damage isn't completely done by the time a decision is reached.
Actual prevention of malware attacks is the domain of extra-judicial agents working at security companies, and they usually disable malware by injecting their own payloads, something that even currently is highly illegal, and sometimes causes the justice system to go after these individuals.
The answer to this question is obvious and the question doesn’t have to be asked. In what kind of thinking a product considered malware would imply that its generic components are also malware? It is clear logic fallacy. Same with C&C software - I don’t get how do you generalize it to IRC. I do not also see how this generalization can happen in law enforcement or courts.
1) this is on a spectrum. For libssl it's pretty obvious. For DHT? Significantly less obvious, I would say.
IRC gets a mention because it has been used as C&C for a VERY long time, and hasn't changed anything to prevent this from happening.
2) it's not experienced techies that will make this choice. It's uninformed judges or even police officers directly.
2) it is very unlikely that police will go after such software. They need to connect it to their case first and that requires technical expertise, so it will likely be a cybercrime unit.