Well, he just needs to get them to accidentally add his spy to their group chat. How hard can it be?
If an untrusted user is sitting at the console of a sudoer account, armed with its password, all is lost and any security has effectively been defeated already. While I do understand the concern it seems like something of a moot point.
As far as I'm concerned, open-source has no nationality, even for a public-sector project. Yes, Red Hat is American. They also don't own Fedora.
From the very start, we've been built on the contributions of people from every corner of the globe, why should we care about petty geographical squabbles like this?
Okay, I'm not a fan of this either but let's not get too worried about this. Everyone's known Ubuntu is a joke for a long time and they don't really have much influence on even several of their downstreams, let alone the rest of the ecosystem.