Put another way: it's still a crime to kick puppies, even if you only indirectly kick puppies through your newly-invented fully-automatic Puppy Kicker 3000.
Edit: to refine the analogy: it doesn't stop being a Puppy Kicker 3000 just because you add a screening phase that eliminates puppies designated by the American Kennel Club.
Should the original developers face additional charges for that?
What if the original developers only published the contracts but never deployed them on Ethereum, leaving that up to someone else to do? Is it the author or the deployer or the user who is liable?
I mean, someone has to be liable if it didn't exist before and then it did, but if it's the author and not the deployer, you could be charged for code you wrote entirely offline and published to GitHub (if someone else later deploys it and it sees use).
The answer to all of your questions is the same. When you run this code to facilitate money laundering the deployer gets in trouble and that's how it should be I can't imagine how else it could work.
The code is absolutely free speech, the application of it is not. I can sell you a book that says how to circumvent financial controls, I can even give a talk about circumventing financial controls, what I can't do is fly to North Korea to talk about it.
Take a million dollars and buy something with it. Even just depositing 10k in a bank account gets reported to the feds, and possibly investigated (And using lower amounts is illegal under structuring.)
That's setting aside the instances of civil asset forfeiture where money is seized because driving with large amounts of cash is assumed to be the product of a crime.
So yeah, whether it's a good policy or not, it definitely seems to be the view.
The people charged are the subset of the Tornado Cash devs who ran the service, not for solely developing some code.