Note I didn’t claim anything about technical security. It’s more of an ethical issue. Even if it’s FOSS (which, as seen in the other subthread, its merely pretending to be), it’s helping russian government.
If you want to consider security — security starts with trust. And GRU/FSB will infiltrate and use any segment of supply chain it has in its reach, being less constrained with any laws than NSA. Are you sure that malicious code will be caught in time like with xz?