Arm still does damage when not equipped and not clicked?

You can set connections as a variable allowing you to disconnect them. I assume you read Feahren's post about the Activated event and the debounce.

local tool = script.Parent
local hitsound = tool:WaitForChild("Hit")
local canattack = tool:WaitForChild("CanAttack")
local plr = tool.Parent.Parent
local char = plr.Character or plr.CharacterAdded:wait()
local larm = char:WaitForChild("Left Arm") -- this can be changed im only using this for the R6 body type
local rarm = char:WaitForChild("Right Arm") -- this can be changed im only using this for the R6 body type

local InAction = false -- debounce so  Touched events don't stack when you click
local Cooldown = 1 -- when the tool is activated, the Touched events are connected and after this # of seconds, it disconnects

local larmConnection, rarmConnection

local function disconnectConnections()
	if larmConnection then 
		larmConnection:Disconnect() -- RBXScriptConnections have a function called 'Disconnect'. Firing the function would cancel the event the connection was assigned to
		larmConnection = nil
	end
	if rarmConnection then 
		rarmConnection:Disconnect()
		rarmConnection = nil
	end
end

local function connectTouchedEvents()
	disconnectConnections()
	larmConnection = larm.Touched:Connect(function(hit) -- set the connection as a variable so you could disconnect it later on
	    local hum = hit.Parent:FindFirstChild("Humanoid")
	    if canattack.Value == false then
	        if hum then
	            canattack.Value = true
	            hitsound:Play()
	            hum:TakeDamage(10) -- u can change this value
	            wait(.5)
	            canattack.Value = false
	        end
	    end
	end)
	
	rarmConnection = rarm.Touched:Connect(function(hit)
	    local hum = hit.Parent:FindFirstChild("Humanoid")
	    if canattack.Value == false then
	        if hum then
	            canattack.Value = true
	            hitsound:Play()
	            hum:TakeDamage(10) -- u can change this value
	            wait(.5)
	            canattack.Value = false
	        end
	    end
	end)
end

tool.Activated:Connect(function()
	if not InAction then 
		InAction = true -- sets the debounce to true
		connectTouchedEvents() -- connect Touched events
		wait(Cooldown) -- cooldown
		disconnectConnections() -- disconnect Touched events
		InAction = false -- sets the debounce to false 
	end
end)