Plus didn't US actually sell China military engines in the 80s?
D-30 engines are the stop-gap for Y-20 until WS-20 comes online. There's no point in upgrading a stop-gap that just needs to be upgraded again anyway unless you're in a dire situation.
No, selling those engines to China doesn't mean China can do whatever it wants with them. The US has sold hundreds, maybe thousands of aircraft and engines to China but every sale came with a clause that restricts it from military use, just like the old engines. Stealing trade secrets and hacking computers is something that everyone does and is almost impossible to definitively pin to an entity. Saying a hack came somewhere from China just isn't good enough; you have to prove who did it, from where and prove that they did it under government orders as opposed to acting as a paid hacker for a company. Even if you prove that, in this day and age, cyber crime is just not viewed as seriously as a physical infringement like if you militarized the 737s sold to you under a civilian only clause to use as say AWACs. Basically, people view cyber attacks as simply naughty behavior, not a hard crime. Otherwise, Snowden's leaks would have the US kicked out of every international organization/ cooperation.