I am wary of any supply chain attack and more so if the project is maintained by people with relationships in adversarial countries. The risk of exploitation outweighs the convenience.

I agree about the legitimate security concerns, but not with "we're talking about the nation state, not the people". If life has taught me anything in the last few years, it's that normies are incapable of making this distinction, at least in the Old World.