If you want to talk about possible risks to your supply chain, a single maintainer that’s grossly underpaid and overworked. That’s the risk. The country they are from is irrelevant.

Total nonsense.

A good open-source maintainer won't act maliciously, even when underfunded, until they are forced to.

A FOSS project that is underfunded has its own problems. But if it becomes unmaintained, you can take over or react. The other risks are assessable.

Russia is an oppressive regime that continuously attacks other parties through hybrid warfare. Who knows what environment and pressures the maintainer is under? The more important the project is, the more value it has as an attack surface.

How can they think and publicize "nah, underfunded is more important"? And even going further than that, claiming the country is irrelevant?