Substitute later parts with earlier parts they refer to and it's much clearer: "computer programs whose purpose is to" "enable access to data", when used "[to prepare] a criminal offense". I guess it depends on what the vulnerability was.