The fellow working on the project with me had a lot of specialized domain experience in such things, and told me the actual cracking teams would never put malware in their own cracks, because it would ruin their reputation in the scene.
I'm sure some cracks have had malware added after release by other people, of course, but I wonder how much of it was fearmongering by software companies.
The higher risk thing tends to be downloading cracks from torrents or usenet where there's 3rd parties between you and a scene group.
The problem is, the scene usually isn't about making piracy mainstream. Many release groups only released their cracks within closed circles to show off that they managed to crack a game. The cracks that made it out to the web often came through leaks, hosted on a shady site or distributed through torrents. For an outsider, these cracked files weren't all that trustworthy.
That, together with antivirus software being made completely unreliable because of false positives, made it very hard to trust the .exes/.dlls that I used. Piracy is still a major infection vector today, and I imagine it will always be because of all the fake cracks on SEO hacked websites and shady operations necessary for the original crackers to distribute a crack without copyright lawyers sending you very scary letters.