Imagine if we had said the same about Nginx. Let's evaluate things on technical merits, specially if they are using open source licenses we understand. In this case GPL v3.
Now, let's put the risk at the root of the build system, and leave the lead devs in a country known to coerce, threaten, torture, poison and kill its dissidents.
That's a no from me, dawg. Look outside, it's not 2015 anymore.
Unfortunately… if that’s going to happen, I’d rather have it happen without first having huge security breaches.