The tldr is the official win and nix versions are ok.

The problem is the unofficial android fork.
The original maintainer decided to hand the keys over to someone else, who thought it was a good idea to create a GitHub account with a name stupidly close to the original maintainer. As there is no history with this new maintainer, people are worried about another zx incident where malware is slowly introduced.