If a scammer steals money and leaves escrow to deal with the fallout (~) then I don't think this counts as the flagged user making the victims whole
That's the part open for discussion. You could argue the escrow was part of the user planning ahead for contingencies.
What is the actual contract? Is it a 3-way between the service, the customer, and the escrow? Does the escrow have enough funds to make everyone whole? What are the exact obligations of each party? I don't see how the service could be off the hook here but perhaps this whole deal was structured in some bizarre way that I just don't understand. I think I saw someone mention that some escrow funds are multisig and no longer possible to access, which sounds like a major issue and contrary to contingency planning, but again - I didn't dive deep enough into this.
Here is a different scenario - how would you deal with this:
Service loses money (hack, lost keys, whatever). No worries (for the customers), there is escrow. Service says "we fucked up, escrow please refund our customers". Escrow runs away with the funds and doesn't refund. Whom do you flag and why? Service? Escrow? Both?