I am shocked
Shocked! That tools developed by the good guys end up in the bad guys hands.
This just points out that there are no secrets if someone, good or bad, wants to spend the effort to get them and once they've got them they spread.
If some pentester, internal or external, finds a problem, you should assume that everyone you fear can also find and exploit that problem.
Now if someone could figure out a way to convince management to budget for immediate fixes, then I would really be shocked.