This is covered by the Computer Misuse Act 1990 — specifically Section 3A which covers obtaining articles for use with related offences covered in Sections 1, 3, and 3ZA of the Act.

It's a crime to own the software intending to use it even if you don't actually use it. Arguably, the purchaser intended to use it at the point they made the purchase; people don't typically purchase software like this accidentally (of course there are obvious exceptions like perhaps security researchers wanting to decompile it to understand how to block it in the future, etc.)