You make a compelling point. The key is 'acceptable use'.

Acceptable use is cracking passwords in an investigation with just cause.

Acceptable use is a script to automate the checking of weak passwords, and notify users.

Unacceptable use is an admin browsing cracked passwords, without just cause.

I personally think acting on the information obtained afterwards is acceptable, but some would disagree.

Remember even in some courts, evidence obtained by police illegally cannot be submitted for trial.

I maintain these moral problems are hard ones.