This sounds a bit like the GrapheneOS shenanigans in France recently: it's an opensource project with no product per-se. There's no supplying to anyone; rather people help themselves to grab it. The debate would be should opensource projects like Tor or GrapheneOS prevent sanctioned people from grabbing the freely (as in both beer and speech) available project from the shelf.

(writing this message, I realized how hard it is not to write "product" for the thing graphene and tor make)