It is very easy to distinguish false stars, the important thing of a repository is not the stars but the activity of the contributors, I have seen many times repositories with malicious payloads with 1.7K stars or more.
I understand that no person or company is above the law and that the user should have used a VPN or Tor but I find it funny that Proton promotes itself as a private provider which does not give out user information when it can log any type of user information and give it to the authorities, it is certainly not a private service.