I used to run a crypto compliance firm, which required me to be very active on the dark web. We got tons of offers for corporate secrets and dupes/imitation sellers. But this one surprised me. Contact sells other apple products as well and the serial numbers validate on the official apple website.
Most retail BTC wallets don't offer the option to select UXTOs. The reality is that a large portion of the real BTC users don't even know what a UXTO means or why they should care. I'm hoping that with everything going on with Tornado Cash and the Russia Sanctions, public awareness on this fact will increase enough to justify adding UXTO selection as a standard for all wallets.
although you are correct on their ability to enforce prosecutorial discretion, the reality is that the way they exercise that discretion sets precedents in the court of law. It will be very interesting to see how they go about trialing any of the OFAC cases involving Tornado Cash.
In theory, regulated exchanges could be required to burn/freeze/hold/return assets that interact with the blacklisted entities. This would abstract all essence of decentralized finance and challenge the principles behind web3 finance, but it is theoretically an option.
Another, and probably better avenue, is for financial institutions and exchanges to implement crypto compliance and tracing tools. Then, using such tools to holistically understand customer's risk. If sanctioned coins represent a very small % of the total flow as well as a one-time occurrence, it's likely the customer was the victim of a dust attack and hence presents little sanction avoidance risk.