Well, did gitlab forget how it explicitly said to not hire chinese or russian in fear of paranoid espionage concerns, that resulted in a hiring manager quitting gitlab? I wonder how it would do it people are mistreated in GitLab.
Discrimination is not a solution to anything and should never even be considered as an option.
Now I agree it's an unfortunate solution in some respects. There are moral issues both utilitarian (1000 Einsteins) and idealistic (all humans are equal). There are also work arounds. For most purposes if you naturalize and renounce your previous citizenship you will legally be treated as a national. ITAR only requires a green card.
Arguing against discrimination in a security context though, when nationality is indeed a reliable discriminant, is difficult.
This is what risk assesnments are for. The consequence of every piece of gitlab hosted code, much of it which runs on publically visible servers, falling into adveserial hands is catastrophic. A government may well make an offer too good to refuse.
On the otherhand, there are pleanty of other software jobs out there which pose minimal risk, and many companies demonstrably are more than willing to hire Russians or outsource to Russia.
It's a healthy discussion to have in regard to security in my opinion.