I have the same concern. I don't think when the Russian government is your biggest (or sole) investor that you can say "no" to backdoors similar to those recently found in quite a lot of Chinese Android devices. In theory you can but in practice they can twist your arm enough for you to agree.

Even though I am more likely to trust the Russian gov't compared to the USA gov't, I still can't safely assume they are the best-hearted people in the world and they'll just open-source all the Sailfish OS code and keep the process fully transparent.

I want to believe it but IMO this is the modern arms race and the superpowers are simply trying to make their weapon better than the others. :(