Funnily enough there is some level of control that can be exerted by the US gov via the distros (at least the major ones - see legalese restrictions on Redhat/Ubuntu etc when you want to download , stating the various US gov laws/sanctions that they follow) and also via the kernel - i think some time back Russian kernel maintainers were removed.

So Open source it may be , however there are still pressure points that can be used. I believe this is one of the main reasons RISCV foundation moved to Europe.