This doesn't even need an "academic" answer. A lot of attacks nowadays are done through the web and manipulate a security flaw in some API somewhere. That doesn't need a lot of processing power, that's just a bunch of HTTP requests, so Python's code-efficient HTTP library wins in this situation.

Now, if this were an attack that involved a lot of calculations or brute force, then no, I'm not going to use Python. I'm going to grab C/C++. But again, those situations aren't always worth the computing power.

It's a pretty easy language to learn and is multi-purpose