As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "overpackage" their software. For example, Microsoft distributes Edge for Mac with a pkg installer, even though Edge is based on Chromium, and Google just distributes Chrome as a drag and drop app in a dmg. But you can extract the Edge app out of the pkg and just install that, skipping whatever junk Microsoft decides to do in their installer scripts.

I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.

To add to blub's response, macOS operates on a permissions system similar to iOS. A new application has to ask permission the first time it tries to access anything in your home folder.

Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.

Modern macOS doesn't give access to specific home subfolders to apps.