Hate speech (both punching up and punching down) is protected speech in the USA. So is "injurious" speech that is not defamation or fraud. It's a common mistake.
True threats and a specific form of incitement are NOT protected. Section 230 offers a site protection from some of the liability (otherwise Twitter would have been shut down years ago). But a person posting unprotected speech is fully liable.
The US specifically has a panoply of exceptions to free speech law, some modern (EDIT: not hate speech, but yes creation of a hostile work environment via rhetoric, divulging classified information, the extraordinary legal injunction of prior restraint of speech if the speech can cause injury and its legality will be resolved in an imminent legal case) and some dating back to the founding of the nation (sedition, treason, espionage).
The interpretation of the First Amendment protection is extremely broad (as it should be) but not unlimited.