I read the lawsuit in question. None of the plaintiffs were arrested. Their issue is that OFAC overstepped the bounds of their statutory authority, which none of your arguments address.

I'm also not aware of what US law would have been violated by either

1. Coding and publishing the tornado source code

2. Deploying several instances to the blockchain in 2019.

There's no US prosecutions based on creating or operating tornado. The Dutch one has not charged the person they arrested yet, according to https://www.coindesk.com/policy/2022/08/24/alleged-tornado-d..., so I don't know what unlawful actions they think he's responsible for.