Can you link me to a custom ROM on XDA that was shown to have Malware?
Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.
Are they going to plant malware which steals your banking details? Probably less likely than a random binary package you found on some forum.