I mean, if Hytale disappears from package managers, you still have the version of it installed locally, right? And, the game operates offline.

The most notable example of malware findings was a cancer patient whose whole crypto wallet was stolen. While this sounds like a "once in a blue moon" thing, it was also said on that occasion that the malicious game in question had been around for weeks with no action from Valve. Even acknowledging that Valve isn't a security company, VXUnderground said in their report of the incident: "Valve allowed this malware to exist for just under a month. This is appalling levels of vetting, how can you let such brazen malware exist on your platform. Review the later sections for proof of when the malware was inserted."

This was the notable case, but it's very likely other similar malware pushes onward. Just take a look at the amount of AI sex-focused slop coming onto Steam in January.

It is convenient, by all means, but I would hardly say a game being on Steam by default makes it "trusted".