My point - and I didn't make this clearly - is about the relationship between the company (GitLab) and the customers it chooses to do business with (think: aggressive undemocratic countries and the companies within them that enable oppression).

If you live in one of those countries and find that you are being stepped on by tools enabled and built by a U.S. company, then you're going to question the ethics and intentions of that company.

Until now GitLab has fostered a very positive open source ecosystem, making their own core product available for modification under the MIT license. That's fine, and that seems a principled and ethical stand.

It's still possible that their code will be deployed and used for malign purposes; those are the cases where as a victim you'd contact your (local) law enforcement if there's anything clearly illegal.

What seems a lot more questionable here is who GitLab chooses to peer with to profit from, and to allow influence over the direction of the product and the code itself. That is the change which is signaled in this policy shift - it is that GitLab will do business with anyone, and that employees shouldn't discuss that - indeed they are being told to treat it as some kind of virtue.