"They're not so arrogant about their code being bulletproof that"

The source-code reviews by foreign states are not about checking to see 'if it works' - it's about checking that it doesn't include inserts from NSA etc..

This has nothing to do with 'security review' in the general sense of robustness, it's a 'state actor' thing.

I don't see how there is a way around this.

It's doubtful that Russia will allow them to sell this stuff without reviewing it - and the reverse is true as well - Russian state actors will surely use this 'review' as an opportunity to embellish their own hacking tactics etc..

I don't see any real way around this in the world in which we live.

Russians are going to have to make their own anti-virus. Which I would imagine they are capable of doing.