They removed russian maintainers that are associated with sanctioned companies. Individual russian contributers were unaffected by this.

Even in that case the app doesn’t need to phone home. It doesn’t even need an internet connection on its own. You’d have to download the update yourself and then use the app to apply the patch, which is less user friendly to not-so-tech-savy users but possible. Just send an email with the necessary information to users who have subscribed to receive these kind of updates.