Is the standard for this codified in clear language anywhere, or is it merely based on the whims of some federal prosecutor/judge? If I make digital watches, and I buy coin cell batteries from a supplier who buys battery precursors from a supplier who buys LiCoO2 from a manufacturer who buys lithium-rich brine from a supplier who buys lithium mining equipment from a sanctioned entity, how much of the full brunt of Uncle Sam's retribution can I expect to come crashing down on me?
Worst sin is angering the gods. I would imagine most the time theyll probably just ask nicely for you to stop, then bury you if you don't, but for political or convenient targets they seem fine going straight for the throat.
https://arstechnica.com/gadgets/2011/01/goatse-security-trol...
They were too bumbling to actually do anything that serious but being too broke to run a stock scam isn’t exactly a great character testimonial, and all of that is well outside of professional ethical boundaries in the infosec community.
https://arstechnica.com/tech-policy/2014/04/appeals-court-re...
It’s certainly possible that a court might have found his actions did not violate the relevant laws, but that was not the case in the first trial where he had full opportunity to challenge the prosecution’s claims. You might characterize that as “misguided rhetoric” but that should be your cue to ask whether it’s really true that you understand the situation better than his real legal team.
They can let you keep making money until it's promotion time, or an example needs to be made for an election campaign or they find out your watches seem to be the chronometer of choice of the latest insurgency.
Smaller companies from other countries may not be so lucky so they may actually refrain from such activities.
There isn't ever a sense of "I'm doing enough and therefore the sanctions violations happening are no longer my fault". It's somewhat up to you to determine your risk and tailor your compliance program to address them and to adjust if you're ever wrong.
How guilty you are is a function of how good a job the state department thinks you're doing trying to avoid sanctions violations.