Except they weren't convicted of writing the Tornado Cash protocol. These guys operated a website to create the contracts, accounting for 90% of the contracts issued. Their chats have clear statements of them discussing billions of dollars worth of illegal money from North Korea, various crypto hacks, etc using the service; but they refused to implement any KYC controls for the website. The few controls they did put in place, they (again in chats) made sure they were inadequate to stop any stolen coins from using the service.

That's bad enough... but they went one step further by creating a coin so they got paid for each Tornado Cash contract. They pulled in millions of dollars for themselves while operating a service that they knowingly facilitated illegal activity.

If it wasn't for the website and the millions in earnings, they would have been ok. Tornado Cash -- the smart contract -- is still operating today. Only the website is gone.