ETH/token blacklisting questions

Without looking into it, I've seen that funds can be blacklisted by either a token itself or just by a bunch of well known KYC CEXes. How is this handled? I'll make two claims, and I'm hoping someone can confirm and potentially add more cases I'm not aware of:

​

• They do blacklisting by locking/not accepting ETH/token from a given address (true? false?)

I recently saw a debate in Tornado.cash with worry that CEXes might start blacklisting funds that origin from their mixer, due to the untraceable nature of such funds.

​

• Some tokens have blacklisting built in, like USDT, which can essentially freeze assets held by a particular address (true? false?)

I'm surprised implementations like (how I've understood) USDT freeze are "in good standing" in crypto, given how crypto kind of aims to avoid "bank middle men". What other large tokens are able to freeze like this? Have I misunderstood it?

​

Thanks for any insight!