All you have to do is do something like sneak in telemetry, add some sort of back door, who knows.

There are near infinite opportunities for a bad actor to sneak bad code in, so when you're dealing with a bad actor you just don't trust anything they do.

Running code from people who are tied to an authoritarian government is not something you should be doing ever.