US sanctions on mixers in the past have been associated with an individual, not a piece of code. This is the first sanction to target an open source and non-custodial mixer.
Maintaining code is, in the US, likely a 1st Amendment-protected activity. Operating live services like a mixer (including any RPCs needed for Tornado) is not. (And yes I know this arrest was not made in the US, so that might be the distinction.)
You can take a look at the Wikipedia site for Defense Distributed, which filed suit against the state department for blocking the distribution of CAD files under export control rules. It hasn't been smooth sailing, but many of the legal cases seem to be breaking in the direction of DD. Of course that case is more complicated given that there is both a 1A and a 2A argument.