I'd say this is beyond paranoid (as it seems targeted), I can understand given that your handle is ngcc_HK though.

FWIW, Ventoy is FOSS [1], so, the same rule holds: you can inspect the source and build it yourself.

[1] https://github.com/ventoy/Ventoy