How does it work then? I was stonewalled by various banks investors and insurers over this in berlin…

That shouldn't have happened. The law is super problematic and they can, for example (try to) hit you for finding (or even stumbling over) and responsibly disclosing security vulns, if you were not hired to do so.

But the part about hacker-tools applys only for tools that cannot be used legally (basically none) or are explicitly and knowingly made or acquired to be used illegally (as in you explicitly stated you are downloading this tool in order to get into a computer you do not have permission to get into). They have to prove you are not intending to use it legally (like checking your own network or one you were hired to check).

How did that happen, did they ask you for a complete list of all software that you run?