This does make me wonder how much they made a deliberate effort to build an open source portfolio so they’d look more legitimate when time came to mount an attack. It seems expensive but it’s probably not really much at the scale of an intelligence agency.

Until you figure there are very subtle unicode changes in the URL that don’t diff on GitHub. :)

Also it's not a contribution to C++ but only one of Microsoft's projects around C++.

But your reaction being a common one would make a Chinese name the best pick for a Chines agent wanting to hide their country affiliation.

Depends on the law and where you are. Publicly we have https://www.eff.org/issues/national-security-letters/faq and it's likely that other requests have occurred from time to time, even in the USA.

> No one is being “required by law” to add vulnerabilities

This is absolutely not the case in many parts of the world.