It also comes with bundled malware, so be careful.

Not entirely true. Sourceforge bundles things with their installers.

https://news.ycombinator.com/item?id=8849950

But you could always get a normal installer even then, and I think (don't quote me on that, I never really used SF) Sourceforge stopped doing that after their acquisition ?

Sourceforge stopped it, filezilla did not. And Filezilla explicitly defended the sourceforge practice when it was still in place. They're a very shady project.

It's not just if you dl from sourceforge:

https://filezilla-project.org/download.php

>This installer may include bundled offers.

But the default is ftp. If you don't explicitly choose sftp and an attacker blocks the ssh port and spoofs an ftp server, FileZilla will happily send the password for the attacker to intercept.

Cpanel supports sftp too. Ftp it's just one option and can be disabled.