Iran is known to monitor the internet of its citizens especially social media (of which Github could be seen as a specialized version) and email (where PR notifications go by default) [1]. Even if its not being monitored at the moment, its likely it could be picked up later on by the Iranian government. If the chances are 30%+ that the dev in question could be sent to jail for years, its more than understandable why he didn't merge in the changes.

[1] https://en.wikipedia.org/wiki/Internet_censorship_in_Iran#Mo...

It's probably a case of the person being super careful, as they live in a jurisdiction where a mistake could have tragic consequences.

Probably not, but if a regime wants to persecute someone (maybe they went to a protest?), they could comb through the individual's accounts looking for slightest evidence of breaking the law.

You never know for sure in an authoritarian country, but it's plausible there could be. The Iranian government has engaged in some public efforts recently to get rid of Israel-linked tech.