Only malicious foreign actors are encouraged to survey the security of systems of national interest, since they can't easily get prosecuted. Systems working as intended.

I disagree. Give me an example of a white hat hacker in Germany going to jail.