How does this square with jurisdictions that don't enforce those laws because the crimes benefit them? Should russian cybercriminals who victimize americans be allowed go to whatever country they please, knowing that they won't be prosecuted in their home country (because the government turns a blind eye to their activities), and can't be prosecuted/extradited in whatever country they travel to?

In this case neither perpetrator nor victim of the fraud appear to be US entities, so your example of Russian cybercriminals victimizing Americans doesn't exactly apply. Unless the country requesting the extradition of said Russian from Canada is, dunno, Australia, for some unrelated beef they have, using the crime against Americans as a convenient excuse.

But in this case, the US entity is being victimized. Specifically, they were tricked into violating US sanctions, which can carry criminal penalties for them. I guess you argue that we can simply decriminalize this for the US entity, but that opens a huge loophole for bypassing sanctions. Say you're china and you want to buy some American semiconductors (which are currently banned from being sold into china). All you need to do is set up a company in Russia, buy the semiconductors, promise that they won't be later transferred into china (wink wink), then import it into china.

Bank may not be an US entity is what it appears. Also the bank is supposed to do due diligence. Careful reading of the judgement, indicate that none of the liabilities from the transaction are possibly active, ie, all payments have been made and the matter closed, with no issue of defaults, etc. The question being considered is the 'risk of reputational damage to the bank', which does it sound like a criminal matter?

In that case you stop doing business in that jurisdiction.