Russia and China engage in state sponsored industrial espionage, hacking and sometimes destructive measures frequently. Of course others have as well, but not nearly to anything resembling the same level and scale.
It got so bad at work, we had to block the entire country subnets at our routers. I would also think that most corporations would probably not allow for this. While the recent South Park episodes show a lot of humor, they don't even scratch the surface of how bad things are and how much internal influence and coercion those countries have on their residents.
Some of the best programmers I've worked with in my career are expats from China and Russia, including running a dev team out of China a while back, but I absolutely would not want to do significant (software/development/it) infrastructure business with residents of those countries in practice. It's unfortunate in the software development space in particular.
Limiting access by regional location is something all countries and companies do, especially for sensitive data with complex security policies.
If GitLab's actions really were as you describe, they'd be in real trouble.