Yesterday I learned that a lot of crucial stuff in Postgres was developed by Russians (the list I saw was quite extensive). So if you run nginx+Postgres (like half the Internet?) then WinRAR is least of your concerns
The trust issues with software developed by Russians isn't that the engineers are Russian. It's that the engineers and their families are currently in Russia.
The ability of the Russian government to lean on incredibly talented developers is extremely large.