When you read "Linux malware", do you interpret it as "malware baked into Linux"?
Admittedly the same headline that says "iPhone Malware Surprises Users" would probably read the other way. It depends a bit on the subject. If it said "Lenovo Malware Surprises Users" I'd it expect it baked in too rather than just malware that just effects Lenovos.
"Malware for PinePhone" would make it clearer.
Pinephone doesn’t make software, it just makes hardware. It’s philosophy is they make hardware that’s easy to hack. All the software is community maintained and not official.
That they don't write the software doesn't mean they don't ship with it.