They'd need the system admins, CI infrastructure and code review team to be in a jurisdiction free of this kind of thing, and then treat all changes subject to laws like these as hostile

The alternative is sell software that everyone knows has backdoors. Pretty hard business case to make