General guidance we’ve received for deployment on protected gov’t networks the past few years has been any open source, whether software libraries or models, won’t pass security review if there are substantial contributions from Chinese/Russian/etc. nationals. There’s even an exceptions list for “well known software” where there are vetted versions for deployment (nginx).