i have seen malware that did not trigger anything on virus total. some game engines unfortunately do trigger rather often. renpy, godot, even rpg maker and many others. it is very bad, because malware can easily be hidden in such games, if people get used to ignore warnings.
since itch does not verify developers, i think it is best to try verify an unknown developer yourself. like finding crosslinked social media.
you link to patreon, but the patreon does not link back... ;-)