The developers deployed the Tornado Cash code, and subsequently, had no control over it. They did control one of the front-ends to it, and they instituted blocking of transactions originating from hacks in that front-end. But criminals were free to use any front-end to access the deployed code, and there was no way for the developers to stop that.

In any case, what is being criticized in this particular thread is OFAC prohibiting all Americans from using Tornado Cash code. This is unprecedented, and clearly outside OFAC's statutory powers to sanction "entities".

Despite the US Treasury's claims, Tornado Cash is not in any way an entity, as it is not controlled by any party. It is simply code, running autonomously on a massively distributed blockchain. When someone uses it, they are using zero knowledge proofs to encrypt their transactions. The fact that this act of encryption adds their activity to the same anonymity pool as criminal activity is no more an argument for banning this encryption protocol as it is for banning any other encryption protocol.