It blocks more malicious traffic than you might expect. I would have assumed that bad actors in those nations wouldn't be scanning FROM them as much but that's not the case. I suppose anyone blocking them is just off their list of targets as they're not being low hanging fruit.
For some companies it is like flipping off a light switch, malicious traffic goes from 100 to near 0 immediately.
I don't like the idea of doing it, but as an admin seeing that effect and having limited resources, you do it.
You'd have to record IP ranges and other things, but you could do it.
Or you can ask them to blackhole the rest of the world and add exceptions if necessary.
If the endpoints are not under your control to that extent, then I'd argue that "all the residential ISPs in US" is just as bad as "all of China/Russia" due to botnets.
Visit the same website from 100km away in Singapore and it’s like your in the US.
The question now is, will any civilian communication survive the battles of nations and currencies.