For me, the most fair solution that the casino should give the whole deposited money back, it should be calculated by how much the total deposit and total withdrawal made by the players so far. Or in other words, there is no side take an advantage against each others. There can be an exception for the casino to forfeit winnings even the deposit from the players, it is if the players realize that they are coming from restricted jurisdiction but they are bypassing it by VPN. I have to agree if casino warn players earlier even before people try to register an account. I am sure casinos can implement a system to detect where the visitors come from so it may avoid this kind of situation. Once visitors are warned earlier but they force themselves to register-deposit-play, the casinos has the right to do as what the terms they have.
Problem here is that most casinos are greedy businesses who won't bother going the extra mile trying to help players from restricted countries since they stand to lose in the long term which sucks, but is the reality.
The person who lost his money sadly only has himself to blame for giving them the perfect opportunity to screw him over while keeping their reputation intact simultaneously.