Have you seen unicode? They usually err on the side of including everything, including, e.g., alphabets of fictional languages.

Those fictional languages' mere existence isn't perceived as a threat by any government, though.

Whoever renders the text. Since most applications delegate to the OS for that, it's typically the OS. The OS generally follows whatever the jurisdiction it's sold in requires. In theory an application could override it by doing custom rendering of these codepoints.

The unicode standard doesn't care, as explained above, since it just defines an alphabet and takes no position in which country/locale codes are to be rendered with a flag.