Can't speak for GitLab specifically, but I have spoken to Persians living abroad that had their credit cards cancelled, bank accounts frozen, and SIM cards simply stopping to work. One of them hasn't lived in Iran in two decades and denounced their citizenship half a decade ago.

Businesses don't care. It's easier for them to have a couple of false positives than it is to deal with the possible consequences.