That opens a can of worms from a legal perspective, and they are a US business..

EDIT: It's one thing to accidentally be violating an embargo, it's another thing entirely to suggest ways to bypass it on your company site.

GitLab doing so would be arguably a deliberate violation of sanctions. While GitLab is not responsible if users decieve them about origin by using a VPN, they absolutely are if they choose an compliance mechanism that can be tricked by a VPN and then point people from sanctioned countries to a VPN provider that will trick their compliance mechanism.

The law can be stupid, but it's rarely as stupid as the people suggesting simple hacks around it think it is.