Everyone has agency. “Just following orders” is not an excuse.
If someone asks you to implement something that crosses an ethical line for you, you ALWAYS have the agency to refuse. It’s hard, but it’s critical that we never give away our own agency and control of our own actions.
You may not be able to stop an implementation from going forward, but you ALWAYS have the ability to not contribute to such an implementation.
depends on your safety barrier. In some very high profile cases, depends on your life. I commend people like Snowden but I certainly wouldn't choose to spend my entire life running from the US government in an attempt to be ethical. I have too many selfish personal goals to try and attempt to sway the masses like that.
You wouldn't have to flee to Russia for refusing to ship spyware in a mobile app, for example.
This is already done for financial statements.
If you put out software that is actively causing harm, you should know your fingerprints are on it
Employees like devs would be protected by professional insurance. That would cause bad management to shape up, or otherwise lose inaurance coverage.