I agree, if Google decides to blacklist your domain you basically own a pile of bitter bitter ashes. Is there an effective appeals process if this happens?
I looked into it when LetsEncrypt announced their plans to use Google's backlists. Here's what I found for myself, copied from there [https://community.letsencrypt.org/t/the-cas-role-in-fighting...]:
Google's Safe Browsing FAQ [https://developers.google.com/safe-browsing/safebrowsing_faq] lists three types of sites which receive advisories: Phishing, Malware, and Unwanted Software. Two of the three types provide an appeals/delisting process, but "Unwanted Software" does not. However, it may be that LE's proposed use of the Safe Browsing API is only looking at the first two types.
If your site appears on the malware list, then both Firefox and Chrome will produce giant warnings on your site that will cause almost everyone to refuse to browse there. So you'll have much bigger problems than not getting a certificate, and you will need to get yourself removed from that list anyway. (And, for that matter, figure out what got you on that list, such as running an ad script that serves malware, or having your server compromised and serving malware you don't know about.)