(2)
TOR or AD network hacked to fire?
Remotely technically possible, but odd timing/opportunity to give up your secret hack to Iran. I can think of higher value targets to use a one-time trick like that for (if it even exists).
What about the TOR warhead/fuse/pointy-thingy?
The nose and its movable fins are the guidance unit, not a warhead. No fuse, no explosives. The warhead is behind it. First, Bellingcat said the picture came from the crash site. Then Bellingcat said from the same neighborhood where the video guy was standing. But the TOR guidance units should be found in the vicinity of where the missiles have detonated, not at the crash site. The nose looks like it was placed conveniently next to a wall. There is no sign the nose cone thundered in from altitude.
Full disclosure: Bellingcat works for the Atlantic Council which is funded by NATO. Take everything they say with a grain of salt. Their analysis is hardly impartial.
Was this 'incriminating' evidence turned into the authorities? If so, the Iranians will be able to trace it back to the unit that supposedly fired it. Of course, they could just drive out to that TOR site and look for an empty launch tube. From there I guess they decide to cover it up or not.