> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to

Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.

Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.