Each of the villains has their own flavor, and each suits a different style of play. It's worth reading the Play Style chapter of the DMG (page 34) and considering which suits your group, then reading the chapters relevant to the four villains to see which suits your campaign style best. In loose terms, Jarlaxle is intended as a swashbuckling anti-hero with a bit of a spy-movie feel, Manshoon is a villainous mastermind at the center of his well-defended lair, and The Xanathar is an eccentric and sometimes darkly humorous oddball character.

It's worth considering that the Summer story arc with the Cassalanters as villains is, by design, a tough moral dilemma to face the party with. To quote Dragon Heist co-designer James Haeck from an article in DnD Beyond:

The most horrific moment of the entire story happens when the player characters make a no-win choice at the end of the Cassalanter storyline.

This refers to the fact that the plot driving the Cassalanters as villains is built around

a sort of Trolley dilemma, where the party's success in the scenario dooms two children, while their failure or inaction dooms 99 strangers.

In light of all that, pay special attention to list of questions on page 34 of the DMG, and compare them against the 4 villains presented. Answering those questions will help guide you to the right choice for your group.

When the text is unclear, look for examples

Surprisingly this relies more on text interpretation than rule interpretation, which is probably where the confusion lies.

Normally a weapon description would list a die number (1d6, 2d6, 1d4, etc.) in a table for the damage numbers. From there it was on the player to know to add your ability modifier based on the attribute used for the attack roll (PHB 194). Unfortunately the damage for this weapon is described inline with the weapon description.

The bow shoots oversized arrows that deal piercing damage equal to 2d6 + the wielder's Strength modifier

has two possible interpretations:

1. 2d6 + STR is the weapon's base damage and you should add your Dexterity in addition to this
           ^{(if a weapon description said "...piercing damage equal to 1d10+1" then you would expect to add dexterity, after all)}
2. 2d6 + STR replaces the final damage value of a normal bow attack: 2d6 + DEX.

Both of which are valid. In this case the confusion lies in the flavorful wording mixed with attribute modifiers being unusual for weapon damage descriptions.

Use the NPC as an example of the intended usage

The NPC using this bow is an example straight from the designers about how this bow should work and can help us at this impasse. You cite that they are listed as having attacks from the bow with damage equal to 2d6+4, and they have a Strength and Dexterity modifier of +4. Because it is not a +8, we can infer that the bow is intended to use STR instead of DEX and not STR in addition to DEX in the hands of a player. A more accurate version of the text might read:

Attacks made with this bow deal 2d6 piercing damage and adds the wielder's Strength modifier instead of their Dexterity modifier.

The Attack Roll

The PHB(194) has this to say about the ability modifier for Attack Rolls:

The ability modifier used for a melee weapon attack is Strength, and the ability modifier used for a ranged weapon attack is Dexterity. Weapons that have the finesse or thrown property break this rule.

However there is some debate surrounding page 196 where, while talking about Damage Rolls, the PHB says:

When attacking with a weapon, you add your ability modifier--the same modifier used for the attack roll--to the damage.

Where it could be implied that the ability modifier and the attack modifier must match. Because the former statement regarding the attribute-to-range assignment is explicit, directly under the heading regarding attack rolls, and specifically mentions exceptions to the rule, I don't consider the justification strong enough to imply that the weapon would use Strength as the attack modifier because of the excerpt on page 196. It appears to have been meant only to tell the reader that the damage roll attribute normally depends on the Attack roll attribute.

Neither the NPC description nor the weapon description mention explicitly a different attack attribute modifier, and there is no rule stating explicitly that attack attribute modifiers must correspond to the damage attribute modifier.

We are left with the following: The general rule for ranged weapon attack modifiers using Dexterity applies, with an intentional override changing the damage roll modifier from Dexterity (as would normally be inherited from the Attack Roll) to Strength. The bow makes attack rolls adding Dexterity and damage rolls adding Strength.