code is protected by free speech

This is true in America (sort of) but not everywhere. Blockchains are global. The code itself might not be a crime: running it made a crime happen. If I was running witness code which controlled millions of dollars belonging to people I'd never met in any and all countries of the world I'd be fanatically careful about what I ran.

I'm not a lawyer. I've had a completely torrid time with lawyers in Israel on a non-internet business case (finally over - draw, the lawyers won) so my first instinct is to run away from lawyers.

However: I'm trying to make coders understand the implications of what they're doing. Spending $500 on a lawyer to at least give you a hedged opinion that what you're about to run in a hard fork (or even a soft fork) is broadly permissible or at least defensible, seems like a small price to pay compared to block rewards.

Steem Witnesses did SF 22.2 without legal cover as far as I know, it is almost certainly ok, highly defensible and not a crime. I'm not sure what legal cover Justin Sun and the other conspirators had with HF23. Maybe none as well. I find it hard to believe they found a competent lawyer in this field to say HF23 is fine.

So who's at fault? The witness that signed the block?
Yes

The other witnesses that allowed that block to become permanent? Yes

The centralized entity in the background pulling all the strings? Yes

A criminal conspiracy. They all needed to take the pre-announce, pre-planned actions. I suspect that Sun, Steemit Inc and the three known human witnesses will all be co-defendants.

And answering something you said elsewhere (which Andrew has also addressed) LLC, LTC, and all other forms of corporate shield go out the window at the first hint of criminality AND they open you up for personal liability of debts owed by the corporation even if that wouldn't ordinarily be allowed. Rule 1 of being a director or owner of a company, don't break the law and don't allow or instruct your staff to break the law.