That's because the transaction isn't reversible/is hard to trace the funds. It's not that "code is law" in the sense that smart contracts are extralegal. They would and should have legal recourse if the person were caught.

And coins like USDC can blacklist addresses and comply with regulatory asks. It's hard to buy your argument that smart contracts are extralegal when there are operators that comply with legal authority.