I brought this up a month ago regarding the lemmy repo. At least they have mirrors and won't be fucked if the orange terminator decides opensource is a danger to US companies or whatever. But there are many projects that would be absolutely fucked. An infinitesimal minority probably backs up their github issues and PRs.
Projects like nixos and probably the entire rust ecosystem would break. They are all in on Github.
The US defunded TOR, Tails, and F-Droid. There also was a time when cryptography was embargoed by the US.
So yes, IMO the US is a risk for opensource and the majority of the opensource community has sleep-walked into a gilded cage. Rattling the bars hasn't helped and it is only when the door closes that they'll wake up. Luckily, this isn't like climate change where there's no way back within multiple generations, but nonetheless, the awakening will be rude.