Except you're confused about the negative impact of the two examples.
In your hacking example, the negative aspect to it is "damaging service, stealing sensitive information,". Which doesn't happen in scenario #3 because it's done by "professionals" who are presumably above that sort of thing.
In the selling arms to mexican cartels example, the negative aspect is selling arms to Mexican cartels. Who then go and shoot people. And that is happening whether nor not it's cops doing the selling.
Here, lemme show you. Let's say we were to take your hacking example and apply it to the issue at hand:
Scenario 1: Selling arms to mexican cartels isn't illegal. Result: Prices bottom out on weapons, the mexican cartels are well armed, and lots of people are shot
Scenario 2: Selling arms to mexican cartels is illegal. Result: What we have now. People that sell arms to mexican cartels are put in prison. When we find them. Presumably this drives up the cost of arming the cartels and makes life harder for them and in turn makes illegal drugs more expensive and less prevalent. If you believe in that whole free market thing at least, and believe the war on drugs has a prayer of working.
Scenario 3: Like scenario #2, but cops have an exception. Result: Just like #2, but quantifiably worse for every weapon that the cops sell. Because each one is going directly towards the negative impact.
Unlike your hacking example, where the negative aspect is a side-effect of people learning about network security, the negative aspect is EXACTLY what the police were doing. They are DIRECTLY CONTRIBUTING TO THE PROBLEM.