This works with the smart contracts with USDC, it's just that there's an authority which has permission to update the state to deny transfers from a specific address.

This is because USDC is a centralized stablecoin (as is USDT). There are decentralized stablecoins such as UST and MIM (and I believe DAI as well).

Correct, though on second thought, given how slow many DAOs are to operate, the perpetrators would already be in some other uncontrollable currency by the time people voted to blacklist certain wallets.

A DAO could have a privileged user (voted in by the DAO of course) who has the ability to blocklist specific addresses that aren't explicitly on an allow-list. Then the DAO vote could add accounts to the allow-list.

Doing so would mean the token could be transacted, except by users who are on the blocklist and not on the allow-list. And this would prevent a privileged user from abusing the power to add accounts to the block-list. Getting unblocked at the speed of DAO is less of a concern, as long as blocked account-holders can still vote with their tokens.