Are there any vulnerabilities? Asking for a friend

Close enough guess. Russia

500/500 for around 10 eur per month

Be my guest: https://normativ.kontur.ru/document?moduleId=1&documentId=453093#h31

I know Russian and I have read the law, full text is available on the government site.

Don’t be, as Torrentfreak is not reliable source. Screenshot of the law on their site is about measures, similar to GPDR in Europe.

Law about external auth services is talking only about all these login buttons like login with Google, with Apple, or Facebook.

It is not required to use service (it’s Russian e-government service, pretty useful). There are still several options (yes, there is VK com, Russian “Facebook”). And it does not explicitly forbids plain old account creation with an email.

Add “in the same place” and you would have said Siberia without saying it

I second this, if you only need to sync files on different locations. Syncthing is awesome and very reliable. Using it every day for several years