In the finnish example they didn't know his ip address at the beginning. The only thing they could do was send money to him using his DNM website and then wait for him to do something with it. They did that, and when he sent the monero to an exchange, they recognized the address, contacted the exchange, asked them what account he sent the money into, got the KYC info for that account, and went to his house to arrest him.

That is an example of a situation that lightning fixes: they can send him money but they can't see when it moves next. So they don't know he sent it to an exchange, don't get to read the exchange's address off the blockchain, don't know to call them, and don't learn his KYC info.