"Code is law" is either nonsensical or redundant when applied to a complex Turing complete language such as Solidity.
If you can't accurately predict the implications of the lines of code in a smart contract, then it's as good as saying "The laws of physics are laws. That ball ended in my garden following the laws of gravity and thermodynamics, asking for me to return it to you is breaching the initial promise of the physical world". This may change with better smart contract languages that can reconcile intent with effect[1], but while talking about complex Ethereum smart contracts, the "Code is law" argument has no value.
Furthermore, as long as you keep within the bounds of trustless cryptocurrency (unfortunately not a tautology these days), code is indeed law. The ETH this person acquired cannot be confiscated.