I guess most methods of attack on a FOSS projects are independent of the country of origin. But, I could still see them being forced to do things they don’t want in the US, without being able to tell anyone. Hopefully if that ever happened it wouldn’t be too hard to detect, but you never know.
I think the be careful what you do on Facebook is implied. He’s highlighting something that’s less expected, where you may need to be careful what you do on Windows systems.