US agencies have too many overreaching regulations like the OFAC one, together with a lot of fake regulations.
The SEC was close to FTX and totally blind to the whole fraud operation that was going on. Likewise, many things in traditional finance markets (debt collaterization, etc.) are legal and regulated, but they're often nothing else but outright scams.
Also from other source it sounds like when it comes to money it's rather "presumption of guilt" where you have to prove the source of your income is legal etc.
Tornado Cash is a sanctioned entity. Author knows the money came through Tornado. That information is sufficient to potentially make accepting the donation criminal, regardless of whether the original source of funds is a privacy-conscious, legit crypto investor, or a ransomware group in North Korea.
Has that money come from a sanctioned person? Is it a drug dealer trying to launder funds? Is it from a hostile state? Is it really a bribe? Is it a mistake?
When the auditors (or worse) come knocking, you want to be able to account for the source of funds in your projects.