I'd also add that if you're a developer do not download games with your developer account, that's their jackpot, after all the best way for them to disguise their scams is when they steal a legit account.
That explains the hacked accounts with the followers and payment options cleared.
But for the methods they use for hacking, I doubt that it would make much difference. The downloaded malware is not aware that it was downloaded by any itch account. It just steals what it can get and does whatever else the malware does. It surely targets itch credentials, stealing cookies and making 2fa ineffective.
If there is no root kit and escaping with it, at least sandboxing would protect the credentials.