Tornado cash could have (for example) implemented AML or KYC policies to achieve the same without coming under the suspicion of assisting criminals.

Given the high data protection requirements warranted by operating a financial service, users could be reasonable sure that their Pepsi purchase remains private.

Of course such measures would run counter the intended use of Tornado cash, including money laundering, but that is their problem and no one's else.