At some time in the past, the US, as a democratic society might have done something to separate offensive and defensive intelligence, used some method to give us something like an assurance that concern by American officials would mean that Kaspersky was doing something shady rather, say, that Kapersky was one tool they couldn't use to spy (not that I know anything about the situation at hand).
But as it is, the US (along with all the other states, of course) produced a situation where there's no real difference between the "state actors", where basically every software product from a given nation risks being requisitioned as well be spyware for that nation.
Perhaps it's just as well and anyone caring about privacy will move to all open source, defined builds and so-on.
Or perhaps just buy software from the smallest, least important nation.