What would he the difference between this hypithetical github repo and a fake B2B service company?

Seems like the same issue already exists.

Agree. No solution in both cases, governments cannot say “it’s a donation to a guy maintaining a gothic repo, therefore it cannot be anything criminal”