FSB security certificates are officially added into system, can be easily found on google. Also, I don’t need any proofs of malicious intent for anything russians do, since they bomb my city everyday.
By the way, it’s very naive to think a totalitarian country – at war – will not put any surveillance in state-controlled OS, for state-controlled devices, which are developed primarily for state agencies