I do it all the time, assessing trustworthiness in a heuristic fashion. Game looks legit, website clearly belongs to who it says it belongs to, etc.
What really does itch.io or Steam offer in the way of protection if a developer wants to be malicious anyway?
P.S: This game and its sequel are really good, and as far as I'm aware this is the only distribution point: https://silverspaceship.com/promesst/
more eyes; if a game contained some kind of malware, there will likely be reports made on the game discussion page (hosted on steam), and game will likely be taken down with enough complaints
i've seen this happen before when some random game added a cryptominer in a silent update
It's even worse than that actually. Steam seems to have no problem with apps or games that require elevated/admin/root permissions to run, while at the same time a lack of code signing on those executables, even if the permissions on the file/folder allow modification by any user on the operating system. Some games carry recommendations by the developers, support, or the communities themselves to open up those permissions or run the game as an administrator, to "fix the problem". If you dare raise a concern, you'll be heckled and mocked.
The carelessness around security is pervasive in the gaming community and Steam isn't helping the situation, likely because it would be bad for revenue.