Is Railgun legal?

I have a question. Tornado Cashe was sanctioned by OFAC. However, if you look at the Etherscan, FROM, TO do not appear, but they are often indicated as Rail. Railgun side says it is legal on their official website. The reason is that if the NTS(IRS) requests the disclosure of transaction information, you can submit the information in response, so there is no problem. This is where my curiosity arises.

The NTS has obtained information that the Colombian mafia uses Railgun to launder funds. However, through EtherScan alone, it is not possible to know who the mafia is. So, when Kim Jong-un heard that the NTS was in a state of panic, he was delighted. He paid anyone in Iran through Railgun to buy the equipment needed to build a nuclear bomb. Kim Jong-un tipped Putin and Xi Jinping off about his success. Then the pair, too, happily settled the arms import and export funds needed for the Ukrainian war through Railgun.

In this case, the OFAC and NTS will come to a boil. Eventually, the NTS will require all railgun users to disclose TXs' information. Doesn't this mean that the Railgun's privacy protection is meaningless after all? If you transfer coins through Tornado Cache and disclose all information to the NTS, there is practically no difference between these two methods, right? After all, wouldn't Railgun be subject to sanctions just like Tornado Cash?