I for one am going through quite a culture shock. I always assumed the nature of FOSS software made it immune to be confined within the policies of nations; I guess if one day the government of USA starts to think that its a security concers for china to use and contribute to core opensource software created by its citizens or based in their boundaries, they might strongarm FOSS communities and projects to make their software exclude them in someway or worse declare GPL software a threat to national security.
This does very little to protect against supply chain attacks.
Your example shows that too.
Increasing modularity and reducing complexity of software seem to be the right way to that end. Plan9, GNU Hurd, Minix3 are interesting in that context.