Am I correct that in theory being an LLC only protects you if you've done things relatively by the book?
Kind of, it offers a veil of protection but that veil can be pierced if there is sufficient legal basis.
So if anything was played fast and lose with contracts they signed or legal violations the creditors can try to get a judge to let them go for personal assets?
There'll be a lot of factors to consider but the simplest summary of the most obvious issues.
A company operates under the instructions of it's director(s)/officer(s), so in the event that they give an unlawful instruction they can make themselves a liable party for whatever action (say, defrauding people by selling products they aren't going to make). That's just a straight forward chain of accountability, and since Justin is the only officer in his companies - he is by default the liable officer.
A company can offer protection from liability, but this relies upon clear boundaries being in place for all important matters - so the company funds must be kept separate from the individual funds, business contracts must be to the company - not the individual, etc. Where the individual is managing multiple companies with interlocking interests, they must be clear on the terms of agreements between companies and there is an expectation to treat them as separate, self-interested entities (this bit can be very... fuzzy).
So some immediate issues that spring up in this bankruptcy are:
Hardwire Tattoo, a business owned an controlled by Justin, has no independent business reason to extend a loan for $190k to a TSR LLC, particularly when TSR LLC is not demonstrating any ability to repay that loan (highest sales year wouldn't cover the rent it allegedly owes).
TSR LLC has a "verbal contract" with Dungeon Hobby Shop Museum LLC, another company that is owned and controlled by Justin, for a royalty rate that isn't a reflect of business practices.
Dungeon Hobby Shop Museum LLC seems to have, at an unspecified time, inherited the museum/shop business, and OSR Games LLC seems to be inheriting the Facebook pages, etc. There are a number of items not accounted for, such as the IP for Goblinz. Those Pesky Goblinz. A Role-Playing Game by Justin LaNasa, Dungeon Crawl, etc.
All of these aspects could be scrutinized and potentially provide evidence for a party to make an argument that Justin has not been operating these as separate business with separate interests, operating for their own independent good, but rather has created an intermingling of interests with the companies and his own personal finances.
When that occurs, a creditor is able to argue that they should be allowed access to the intermingled assets (especially if there was an unlawful transfer to avoid accountability) and it can be ruled that the officer who has been intermingling is personally liable to some degree. The specifics and to what degree are generally complex matters tied up in particular laws, guidelines and the discretion of the court so are very hard to estimate - suffice to say that if most business people always conclude it is better to avoid finding out.