Since this thread has been revived, a few points.
If one sees adult games all the time, yes, than the settings are enabled to see adult content or one has uploaded a nsfw/sensitive content project and cannot deactive the setting because of that. One can just open a game in question in a new private browser window to have no cookies and if there is an adult warning, the game is properly marked as nsfw. If one sees it anyway in regular search and browse, then the setting is disabled or ignored. There are or were ways to ignore the setting by browsing nsfw tags like "adult".
Some malware uploaders do not mark their malware project in the hopes that in the time span between uploading and removal their payload was downloaded to infect people's machines. But with indie publishers it also happens that occassionaly people forget to mark it as sensitive.
The criteria how to spot malware are ever changing. There is no single green or red flags. The criminals try everything and if they notice something is a green flag, they will try to fake it. And if a red flag is too effective, they change that. If people warn about exe files, they change to rar, if people warn about rar files, they change to zip and so on. If disabling comment section gets them quarantined easier, they enable comment section and so on.
They do try everthing and they will reuse what works. They just try variations till they get through filters and under the radar of people being suspicous and willing to hit the report button.
That's another problem. Malware is not often reported. I have seen malware out in the open for half a year. Longest was two years. And a lot that were a month old. Please report malware if you recognise it and tell in the report why you think it is malware.
Speaking of the report button, that was changed a while ago. You can select the category of why you want to report something. Malware would be the malicious category. And not properly marked nsfw games the miscategorized button. Pirated games would be the not authorized.
The games that are talked about in the psa about do try my game on discord scam, are usually password protected and those pages did not have a report button. Maybe that has changed, but there are pages that do not have a report button either: blog posts. They have comment section, but you can't report them with a button. There is malware advertised every day on those blog posts. You would need to send a mail to support to report those.