The risk here is that Jetbrains has significant operations in Russia. It is likely a lot easier to get an FSB agent hired into a Russian office. And in fact the Russian government can just order and enforce cooperation. The USA does this all the time and every operation is classified. I would not expect anything less from Russia or China. The companies registration in the Czech Republic (or anywhere) does not prevent this.

Kasperkey is even more obvious because the founder was involved with the KGB even before the 2017 ban. It should never have been used. Now maybe Kasperkey's affiliation is akin to a "communist youth party" card and not necessarily a genuine affiliation but the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe.