The security issue is very likely scenario. If you’re in Russia, you can go to jail at any moment on totally bogus charges. It is very easy for FSB to pressure some random kernel maintainer into adding hard to detect backdoor into their code, it will be XZ situation all over again.
Hey, do you maybe know the Polish alphabet song? I was searching for it on the internet forever, but I don’t speak Polish so I could not google the correct phrase. It started like this (reconstructed from oral lore using Google Translate):
Berlin miastem w Niemczech leże
burdel - miejsce dla młodzieży
guzik to jest częścią ubrania
gówno jest produktem srania
dynia to jest do jedzenia
dupa to jest do pierdzenia
…
And it supposedly continued all the way to letter Z.