How exactly does hacking the code of the game not violate the ToS?

It does violate it but no one cares as they are not modifying the code and republishing it. All they are doing is peaking under the hood and telling everyone whats under there.

The reverse engineers publish their results public.
If niantic had a problem with this, they would tell this with a clear voice. Obviously, despite violating the toss, this is accepted.

i think it all comes to the unfair advantage , every one have access to this info and it is published for free
also niantic have been supportive to this kind of talk and hype as it promote to the community and make the game more inclusive and interesting , more than once they put Easter eggs and or said they have something hidden in the game

It is a violation...no question - but it is up to Niantic to enforce that.
I guess it just makes up for Niantic's lack of decent communication. Why not just let others release information for free, rather than have Niantic do the work and pay an employee?
Clearly Niantic prefer it this way.

If they do ever feel the need to stop other parties from decompiling their products then they will look a little hypocritical, by having employees frequenting the most vocal of the sites that do it and flaunt it.

Don't get me wrong...I take advantage of the information gleaned when it gets done, but I can see this causing Niantic to look hypocritical if they ever do need to enforce that particular part of the ToS in the future.

"Hacking"

There's two parts to the code. The client part (on your phone) and the server part (on Niantic server). What is being done is simply looking at the client code which is the only thing you could look at since it's local. On that side, there's absolutely nothing you could do on your phone to give you an advantage over other players. You could likely do something like change the color/picture of your pokemons (stuff that may be stored on your phone), but you could not change the strenght/movesets (stuff that is stored on the server). But looking at the client code, it does give us information, because stuff that come from the server is pushed to the client code, and as such variables names give us some clue. Currently, all they do, is interpret what a variable like "boss raid enabled" can do. Nothing more.