I imagine that aggressive states might try to go after developers who work on a project, even if the project has no entity beyond a github repo.

Roman Storm and the Samurai guys are a different case in many ways, but I'm not sure that attorney generals have to stretch too far to start claiming that lead maintainers for FOSS operating systems are responsible for implementing their tyrannical age verification laws.