That’s a pretty strong statement to make without backing it up with some evidence of foul play, or at least evidence of these links.
If you have evidence of foul play it's already far far too late to do anything.
With authoritarian nations and their ability to control and steal your projects, you assume guilty until proven innocent. You should require there be a real audit before you trust gitea.
Half of gitea's contributors are from Europe. Wait until you learn how much "Chinese" code is in the Linux kernel these days.
This anti-Chinese hysteria is hilarious to watch from the sidelines, honestly. A few months ago there was a comment on HN by some American whose company was rewriting their frontend when they learned that antd (a React component toolkit) was developed by a Chinese company.