If an org is a CIA cutout (like the National Endowment for Democracy), yeah, be suspicious of everything it does. But that doesn't mean any individual affiliated with it is basically a spy -- the whole point of running a cutout instead of another branch of the CIA itself is to fool people into thinking you're doing good things. Some people fall for that.
If an org receives all of its funding from a CIA cutout, yeah, just treat it as another CIA cutout. But now it's easier to imagine individuals working with it without knowing the full story.
If an org receives some funding from a CIA cutout, well, where's the rest of its money coming from? If it can only exist because of that funding, that's pretty sus. But if it's mostly self-funding and receives a small NED grant? The influence is more tenuous, and at this point it's very easy to imagine affiliated individuals aren't influenced at all.
What if some individual works for a few different organizations, one of which got a small NED grant? Sure, be suspicious, but treating this person as basically a CIA agent is getting a little farcical.
The farther down the list you go, the more important it is to look at what the organization/individual is actually doing, and not just conclude that they're compromised by proxy.
Yeah, there's a lot more detail to this picture:
The farther down the list you go, the more important it is to look at what the organization/individual is actually doing, and not just conclude that they're compromised by proxy.