I believe it's understood that OnlyOffice devs are (mostly) Russian. And that in todays world Russian software companies have to go through hoops to be able to send/receive invoices/contracts/etc.

Some parts of their portfolio are not FOSS, these are the components in the commercial edition (the hosted/embeddable version of onlyoffice).

I have customers running OnlyOffice and we've never seen anything suspicious in our security tooling.

So I believe it comes down to your opinion/mindset around the whole Russia thing.