kde-look, etc... and 'pling.com' haven't caused any issues so far, SFAIK. That said, it's apparently all user upload. There's (probably tiny, but not zero) room for shenanigans in that regard.

I don't use their app. Instead, I download the things I like and manually vet them to make sure nothing untowards is going on. There never has been, so I'm probably a bit paranoid.

A LOT of the time, that theme, icon set, cursor, or whatever else you like will ALREADY be in your distro's repos. It's usually quick and easy to check, and then do the manual download and visually inspect if it's not available. Installing just means sticking the unzipped folder in your .themes or .icon folders, appropriately.

Protip: A lot of themes, fonts, icon sets, and the like are starting to offer customizable downloads. For example, if you like Bibata cursor, you can go to their website and do all customized colors to match your favorite theme: https://www.bibata.live/studio

Iosevka font is another one that does this. You can pick and choose glyph features for a custom version: https://typeof.net/Iosevka/customizer#gh-light-mode-only

(These are things you could do with the source code, but the online customizers make it easier for newer folks.)