The problem with reversing it themselves becomes very large scale if any player-player interaction is involved (and, umm, this is an MMO, it's all about P-P interactions).
Player A exploits loophole to illegitimately gain 1 million gold
Player A buys 100k weapon from Player B-1, 100k chest-armor from Player B-2, and 100k ring from Player B-3
Player B-1 uses that 100k that he got from a legitimate sale of a legitimately [farmed/crafted/bought] item, and buys 50k worth of consumables
Player B-2 uses that 100k along with 900k that was all made using legitimate means to buy 1m item legitimately
Etc, etc... the list goes on
Realistically, Players B-1 and B-2 have no idea that the money from A was fake/illegal (and in digital world, they have no way of knowing), so they can't be penalized and have their new consumables or big-ticket item removed.
Player A should lose his 3 items, yeah
But, if this were the other way around, and Player A bought 10 items from vendor for 100k each with that 1m that he made, and quickly turned around and sold it to other players for 90k each, or crafted it with other legitimate items for sale for 200k each, you can't really break up the amounts now (as half of that 200k-each is legitimate).
Now, go one-step further, and say Player A shunted that 1m gold into powerlevelling a craft.
The benefits of the higher crafter levels will net him huge, legitimate (arguably), returns throughout the game, especially early-on when other don't necessarily have crafting levelled so high.
Can they simply "delete" the "profits" of their actions? Not without re-rolling their toon, or choosing to never use that skilled craft again.
Back-rolling exploited vendors is a very, very labor intensive process. This has happened in almost every MMO at least once, and also in many single-player games.
Were I ArenaNet, I'd just ban the players who exploited, too. They've all been around the block a couple of times, they know better, and it's not worth the time I pay my devs for to back out something like that.
The players who exploited can always just create a new account (for which they have to buy a new license to the game, one-time) if they want to play again. This not only backs out the problem caused by them exploiting, but it also sets precedent that any breach of the ToS will have a monetary value attached to it to resolve, and that monetary value is capped (at the cost of rebuying the game).