There are a lot of answers to this, but since we're likely coders in here, there's a software design answer worth pointing out.

Watch how police states behave. What tools do they use? Typically, it's roots of trust. They take down sites by tampering with their domain name. They MITM web traffic by compelling certificate authorities to do unstrustworthy things. They spy on cell phones by mimicking external authorities that the phones are wired to trust explicitly and without input from the user. They insert devices into ISP infrastructure which users tend to assume is neutral.

So if we want to prevent this: Don't tolerate roots of trust that the user cannot configure. Use a threat model that includes nation states. Don't design with the assumption that trusted third parties will remain trustworthy. Think about how to protect your users privacy. Prefer peer-to-peer where possible, because your server may at one point become compromised and harm the users. Think about how they can protect themselves if that happens. Give them control over whether to install updates. Publish your API so users can make unauthorized clients if they don't trust yours. Prefer repeatable builds, and check hashes to spot malware. Review contributions and be wary of binary blobs that may have hidden use cases.

Mostly this is just sound engineering. It means doing your job well, which is not always the same as doing the job the shareholders asked for. They invested so they could have leverage, so ask yourself ahead of time if those are the same kinds of levers that police states want to pull. Shoot them down in the design phase if possible, sabotage them after the fact if necessary.