All you have to do is do something like sneak in telemetry, add some sort of back door, who knows. There are near infinite opportunities for a bad actor to sne

All you have to do is do something like sneak in telemetry, add some sort of back door, who knows. There are near infinite opportunities for a bad actor to sneak bad code in, so when you're dealing with a bad actor you just don't trust anything they do. Running code from people who are tied to an authoritarian government is not something you should be doing ever.