So essentially the developer of Tornado Cash is prosecuted for writing and making public the source code of a program.
No. It's because he provided a service and took fees from it, i.e. ran a company. I've read a pretty
good Coindesk article about the matter.
The cases Samourai and Tornado Cash are quite similar. They are about software projects, but in both cases, a group ran a for-profit centralized service with an
instance of that software, taking fees from customers. Tornado Cash had even a token to generate additional profit, i.e. something which could be seen as an unregistered security.
Of course there could have been other people simply forking the software, as they were open source, but that does not prevent the founders to dominate, e.g. running a website with the service's name as its domain. But this is not even needed. Maybe "forkers" of these projects which also ran a profitable business could also be prosecuted on the same premises.
In general I think these cases lead to many questions regarding the current "DeFi" landscape. Most of so-called DeFi projects are non-custodial but have often a similar dominant centralized instance which raises fees. Metamask/Consensys is another example - they take fees from their Swaps feature, even if the wallet is non-custodial.
It's not that I endorse this legal action, I can not emphasize that enough. For me, the "red line" should be between custodial and non-custodial services, and even for custodial ones there should be exemptions based on volume (like in Argentina for example, although the limit is very low with about $30000 USD yearly revenue). Because even Lightning nodes in the US could become endangered if they take fees because they could also be seen as a "business".
However as I've written elsewhere in the case of Samourai at least it's possible that the accusation is simply wrong. The crucial question for me (which I don't know because I've not seen the code nor a sufficient detailed explanation for how Whirlpool worked - if someone knows I'm grateful for an explanation or link!) is if the Whirlpool server signed a CoinJoin transaction (i.e. acted as a market maker with own funds) or only collected transactions from others. If the latter is true then it should not be classified as a money transmitter, the charges would then be probably futile.