If your site appears on the malware list, then both Firefox and Chrome will produce giant warnings on your site that will cause almost everyone to refuse to browse there. So you'll have much bigger problems than not getting a certificate, and you will need to get yourself removed from that list anyway. (And, for that matter, figure out what got you on that list, such as running an ad script that serves malware, or having your server compromised and serving malware you don't know about.)
I looked into it when LetsEncrypt announced their plans to use Google's backlists. Here's what I found for myself, copied from there [https://community.letsencrypt.org/t/the-cas-role-in-fighting...]:
Google's Safe Browsing FAQ [https://developers.google.com/safe-browsing/safebrowsing_faq] lists three types of sites which receive advisories: Phishing, Malware, and Unwanted Software. Two of the three types provide an appeals/delisting process, but "Unwanted Software" does not. However, it may be that LE's proposed use of the Safe Browsing API is only looking at the first two types.
I do feel more negatively about their choice to use a third-party list of domains to blacklist, particularly since they can't offer any effective appeals process (they can't afford to have people in the loop AT ALL at a price of zero)