That holds true for a lot of software and is the basis of a supply chain attack as evidenced by the most recent one utilising Solarwinds software which amongst others affected Microsoft and a number of US government departments.
There are also exploits that can use vulnerabilities in an anti-virus product to gain access to a device, the most recent of these was against ESET another well respected security provider (I believe Kaspersky was also affected by an exploit at one point), one such exploit I recall allowed a file that had been quarantined to be run with escalated privileges. This is one of many reasons why you are always advised to be running the latest version of any software you have installed. **caveat, this the advise given to home users, within a business these updates are usually tested for an extended period to see what new vulnerabilities arise before they are installed in a production environment.
Back to Kaspersky, whilst I have no doubt some of there software development is done in Russia they are a large multinational with a diverse product range and there software development is likely across multiple regions. And they make their code available to partners and governments for review, so if there was tampering it would be evident. And as they are not a communications company they are not subject to the Russian data gathering laws which has been independently verified.
All in all they do a lot more than most companies to show they operate in a transparent and trustworthy manor.
But at the end of the day the best advise is to run what you are comfortable with and does the job you need it to.