First, my interpretation of the legal section of StackExchange. It is my belief that section refers to using the site in a direct way to do these things.
For example, if there was some sort of cross-site attack that could be launched from a client to affect other users/the site/sites negatively that involves using Stack Exchange directly to enable this, then that behavior is a violation of the terms of service.
Moving onto the second point, any piece of knowledge on Stack Overflow could indirectly be used for nefarious purposes. It's my interpretation that the TOS does not cover these scenarios. The applications of all knowledge across the Stack Exchange network for nefarious purposes are mind boggling when you get down to it, so the company has to protect itself in some way, which means that moderators would have to think of all possible scenarios where a piece of information could be used in a nefarious way, which would effectively neuter us and the site.
So it's my interpretation that no, the TOS does not define that questions that have nefarious applications in violation of site policy.
Additionally, I would say that they are on-topic, if it meets the quality guidelines. Someone, after all, might really have forgotten the password to their macro-protected sheet. Or they got hit with the virus that locks all their Office documents and charges an arm and a leg to get the password.
Oh, and security through obscurity is just a horrible practice, so in general, you're probably doing well by the ecosystem by bringing these vulnerabilities to light so that people can address them.