Aside from numerous ethical issues with this story, it doesn’t make a lot of practical sense. They are not major threat to avoid, even taking into account xz precedent - I don’t think it’s easy or even feasible to plant any backdoors to Linux kernel this way. This will not make any impact on Russian government or military operations or impair their OS development effort (Astra Linux will be just fine). It sounds pretty much like some legalese ass-covering met the unhinged personality of Torvalds with the scandal as the only outcome.