i want to give the npc some custom kits, but im a bit afraid if i give them m2, this will become lootable when the npc shot down. and players will exploit the hell out of it. can someone comfirm if this is the case or not.

they should inherit the default loot table for the server.

Try it and find out

They only drop the loot that would usually drop on heavy scientists.