It is possible for sure. what's your point? spamhaus does too with IPs, abuse.ch does too, every enterprise firewall's reputation list does too. that's the whole point of reputation, if it was reliable 100% it wouldn't be "reputation".
You claimed they all are malicious sites or they wouldn’t be included but that’s factually incorrect
I assumed a human review is always in place, if not then you're right and I was wrong.