Considering most people in the world use Windows, dmg is pretty much irrelevant. They can only be opened/unpacked on Macs, so even if it contains a evil payload you won't ever got to it on Windows or Linux.
Exe-files has much bigger impact and can be run through emulation on non-Windows systems.
I'd say exe is a much better choice.