FWIW, I'm in the USA and have firsthand experience of establishing perm residence ("green card status", the equivalent of the UK's "indefinite right to remain") through a US citizen spouse.
First of all, forget about the requirements for a visitor's/tourist visa, including the ESTA/visa waiver. Harry already has some kind of legal residence in the USA and so doesn't need one. The question the HF seem to be asking is whether he knowingly misrepresented himself or supplied false evidence, or had that done on his behalf/with his knowledge, on any official immigration forms. If it were to be proven that he did do this, it absolutely can cause him problems, including being deported and even barred from future entry. That's all speculation, though.
Given the timing of the move to the USA, he likely won’t have started the perm residence (“green card”) process yet (will not have filed form I-90, or only very recently done so). He most likely has a K1 visa (form I-130). I-130 and I-90 are filled out by the sponsor (in this case presumably Meghan), not the beneficiary (Harry). The I-130 is primarily designed to make sure that the beneficiary is related to the petitioner in the way they claim (in this case, that it’s a legitimate marriage) not to weed out undesirables. There are questions on both of these forms about being convicted of crimes, and there are health questions which would probably exclude a CURRENT addict, but nothing about historical drug use as far as I recall. Those kinds of questions usually come up in individual vetting and are likely to be asked in person in one on one interviews at various stages (which may be to get the K1 and also again to get perm res).
One "wild card" in the Meghan & Harry situation is that their move to the USA was in the middle of COVID lockdown and some of the face-to-face work was suspended. It's sort of fruitless to speculate about an individual case, though - if it's somehow important to you, all you can do is wait and see if the authorities come up with anything. If they don't, the general public will likely never know any more details. The USA is notoriously private and cagy about these kinds of details - both to protect the privacy of applicants and sponsors/families and to prevent "gaming the system".
Side note - not sure that it matters but both children have US citizenship via their US cit parent (Meghan), regardless of where they were born.