Website scanning for malware or other undesirable content is extremely unreliable and prone to false positives. None of the three vendors are very well known (except for a few other reports of false positives). If anything that’s a pretty low hitrate on virustotal all things considered. Don’t put too much stock in the heuristics of companies whose business model revolves around scaring their customers and exploiting computer illiteracy.
If I may ask: how practical is monitoring / administering rootless quadlets? I’m running rootless podman containers via systemd for home use, but splitting the single rootless user into multiple has proven to be quite the pain.