I think in such situations it can be withheld but not withdrawn, it's pretty common for universities to hold back credentials until debts are paid. But once it's been given I think the only scenario which it can be withdrawn is if it was given under fraudulent circumstances. Like a newspaper retraction, it can only be retracted if the original statement was found to be false.

The perpetrator should be sued for damages which is the normal thing to happen. Withdrawing properly received credentials opens the door to yet another extra-judicial punishment and we already have too many of those.

(EDIT) I've since googled around a bit and am surprised that there does seem to be a degree of discretion available to the university to revoke degrees that I was unaware of. I had always considered degrees to be like an affidavit, a statement of a fact as the institution understands it. There are plenty of horrible people who have done heinous things and I've never heard of their degrees being taken away. Perhaps one difference here is that the behavior under question was during their undergrad.