Will is be US-based like Mozilla, or will it be somewhere else, like Europe?
A couple of foundations have moved away from the US in recent years, for example the Eclipse Foundation (Belgium) and the RISC-V Foundation (Switzerland).
It seems foundational (if you'd forgive the pun) to know under what laws the foundation will operate, and who (if anybody) will be excluded from taking part in the project because of sanctions regimes.
This seems incredibly far fetched. Paranoia is a healthy practice but there is a point when it goes too far.
The current US administration is already trying today to force close allies to conform to their will using economical pressure. I can imagine a future where this might escalate, so in my opinion forcing US companies to block certain origin countries if not that far fetched.