[AdministrativeA]

One other thought: in most companies, you just don't open an office there. Or you lock your data down. But they don't have the technical capability to monitor or restrict access to prod data (their VP said this).

Because they're remote they can't just not open an office there so they have to restrict hiring to keep Chinese and Russians living in China and Russia out. Normally what would happen is you'd hire them but then not give them access to prod data (usually by saying it requires some background check or clearance you know they can't get) or when it's illegal not to give access, just lock the data down. The alternative is probably illegal, but it's the only one that GitLab has.

[itronitron]

There is no way that not granting an employee access to prod data can be illegal. That sort of access is a privilege not a right.