My point - and I didn't make this clearly - is about the relationship between the company (GitLab) and the customers it chooses to do business with (think: aggressive undemocratic countries and the companies within them that enable oppression).
If you live in one of those countries and find that you are being stepped on by tools enabled and built by a U.S. company, then you're going to question the ethics and intentions of that company.
Until now GitLab has fostered a very positive open source ecosystem, making their own core product available for modification under the MIT license. That's fine, and that seems a principled and ethical stand.
It's still possible that their code will be deployed and used for malign purposes; those are the cases where as a victim you'd contact your (local) law enforcement if there's anything clearly illegal.
What seems a lot more questionable here is who GitLab chooses to peer with to profit from, and to allow influence over the direction of the product and the code itself. That is the change which is signaled in this policy shift - it is that GitLab will do business with anyone, and that employees shouldn't discuss that - indeed they are being told to treat it as some kind of virtue.
I mean if your qualifying rule is everyone in the world, you've given Github the job of being world police. A role that won't make an earth shattering impact because bad actors can make those same programs offline. Why not have it in the light where we can see it coming? Being world police is the gov's job. Github should be treated as an american service and be required to respect only the gov's the US cares about and let the rest of the world use it on an "as is" basis.