> Russian intelligence
Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole.
> and a lack of due diligence.
I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?
Kasperkey is even more obvious because the founder was involved with the KGB even before the 2017 ban. It should never have been used. Now maybe Kasperkey's affiliation is akin to a "communist youth party" card and not necessarily a genuine affiliation but the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe.
Are you getting this from somewhere or are you explaining how you perceive the standards?
The laws I'm familiar with generally have to do with pretty specific criteria for delivering software that touches specific types/classifications of data. None of that would've caught how the JetBrains software was allegedly used to exploit the SolarWinds product. This was some pretty sophisticated stuff.