Putting everything in one bag is never going to work
I've done dozens if not hundreds of risk assessments in my career. When you analyse a threat, it is paramount to consider the actor, target, likelihood and impact of a risk if it were to materialise (amongst other things of course). Picture this:
risk in question: the code could allow China to eavesdrop on the drone users' activities
if the user is the US military --> significant risk, with deep implications that can lead to loss of life
if the user is the US gov --> high risk that could lead to political espionage, large scale economic impact, civil unrest, etc. even potential loss of life (long list)
if the user is you or me --> medium to low risk depending on volume of surveillance/data siphoned (widespread vs small audience). No one will die bc China discovers you like to zoom in on your sunbathing hot neighbour in the summer
Enter risk mitigations:
You can mitigate #3 by forcing the company to do independent code analysis, open source their code (or invite them to use OS if possible), etc.
You could mitigate #2 by doing the above in more detail + gov-led analysis, etc. or even just choose a different supplier
You would most likely ban the tech and choose another supplier for #1 - this is common sense.
So you see, an all-or-nothing approach is hardly ever the right solution. Which makes me think there's a broader, more complex political agenda in place ;-)