It’s very simple. The US government maintains a list of sanctioned entities and companies. US citizens and businesses are not allowed to do business with these entities. Most of the removed maintainers either used their company email, or very publicly are employees of these sanctioned companies.
There’s no investigation of connections or anything complicated going on here.
Also, if you think corporations becoming effective government is some Russia specific thing, I have a bridge to sell you.
That’s not really how Lemmy works, it’s more like Reddit, where you’d probably want to look at communities. But I’ve not seen anyone announce any new vulns here, people just post links to articles about them.
Searching for communities from the db0 instance should get you a bunch related to cybersecurity and infosec (only reccomending as some other instances have defederated from the .ml instance you’re posting from/in). If I have some time later I’ll edit this post with some.