That’s smart, but requires extra work and hardware.

Interesting. If there are reputable packers / crackers, why do they not uses GPG to sign the software? That way, no one can manipulate and reupload the software.

If you notice the malware…

Good and valid point. I use opensource software wherever I can.

Though paid software is not going to encrypt your data for ransom or use a keylogger to steal bitcoin (yet).