What you're saying is that, as the address the developer received the money from was not specifically listed by OFAC as Tornado Cash (in [1]), it wouldn't be a prohibited transaction for the developer that would need reporting, even though it seems like it was just transferred from 0xA160cdAB225685dA1d56aa342Ad8841c3b53f291 (on the SDN list from OFAC) a few minutes before through a few addresses? I don't really know, but if that were the case, that seems like it would enormously limit the applicability of the sanctions?

[1] https://sanctionssearch.ofac.treas.gov/Details.aspx?id=38499

If it's interpreted as accepting money for some implied services (future or past), then that could be an issue if the law prohibits people under US jurisdiction to provide any services to them.