qubes is just as vulnerable as xubuntu in this case (poor website security) no?
Using Qubes would limit the blast radius for a scenario like this. In QubesOS, you would use disposable VMs (with no access to your crypto wallets or other user files) to download and flash an ISO. So even if this malware was targeting Linux, it wouldn't get zit and disappear when you finish flashing and shut down that VM (as long as there isn't an unpatched exploit breaking the VM isolation involved).
Of course, if the ISO is bad then this won't save you from compromise once you boot it. But that's not what happened here.
[1] https://doc.qubes-os.org/en/latest/project-security/verifyin...
Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.
Its not perfect... but its better than nothing.