

Yes, they are legitimate and not just fears. OnlyOffice is produced by a Russian team. They opened an office in Latvia, and in 2023 a holding in Singapore, to circumvent Western measures in boycott of Russia, so they can continue to sell their services.
What’s also weird is that the Russian version of the software package is named after the first Soviet nuclear ICBM and features imagery of that.
Sources: https://epravda.com.ua/publications/2022/07/6/688888/ and https://www.en-zdv.uni-mainz.de/2023/05/30/software-onlyoffice-will-be-switched-to-the-open-source-version/
You are most likely fine using the open source version and none of their paid services.
Personally, I want to avoid any association, so I use LibreOffice.