You can get malware with the download of any soft, independent of it is FOSS or not. The clue is that it is for crackers easier to infect OpenSource if the soft has a deficient maintenance or it is abandoned, as is seen a lot on GitHub with apps that have not been updated for several years, like sadly this one, which was a very good app.

There is a lot of misunderstanding regarding OpenSource, the meaning of this type of software is to allow collaborative development, not limited to a small group of a company’s developers, as in the case of proprietary software, but as many believe, OpenSource is not a guarantee of security or privacy at all, this depends solely on the intentions of the author (not all of these are good guys) of this and that, as I said, that the software has maintenance and if possible an active community. Nothing worse than an abandoned and outdated OpenSorce, worse than an outdated proprietary soft.

It is essential in GitHub or another Git, to look at when it was last updated and, as in the case of any software, to review it with an AV before using or installing it and ALWAYS read the PP and TOS.

No, apt has signatures and a team of maintainers whose job it is to verify the packages match what the Dev produced