GitLab doing so would be arguably a deliberate violation of sanctions. While GitLab is not responsible if users decieve them about origin by using a VPN, they absolutely are if they choose an compliance mechanism that can be tricked by a VPN and then point people from sanctioned countries to a VPN provider that will trick their compliance mechanism.

The law can be stupid, but it's rarely as stupid as the people suggesting simple hacks around it think it is.