The school couldn't assure that all the data going over the wire was protected from these tools, but felt it good practice to teach us. Of course, many students then left the class after the two hours were up and stupidly practiced their newfound skills on the network anyway. After that day, we lost more than a couple students from the class (and possibly the university).
The schools know their systems are insecure. The leadership is comfortable in accepting this risk. I just wish they would make this information public to the students, so they can choose to accept the risk as well.
And there are problems with letting students have permission to run penetration tests - you have no idea if they're white hat or grey hat or black hat.
I find internal auditing, under strict surveillance to be a very good idea indeed. This could even lead to some healthy form of competition between universities, not only base on who teaches that Lisp class, or what professor/university's name is.
This doesn't necessarily mean that students would be allowed to alter the software, but they certainly could analyze and audit it, and perhaps provide patches in some cases.