This looks neat. But how do I know this won't isnt malware itself (or will become malware in the future)

Well, they have a pretty active subreddit at https://www.reddit.com/r/Vanced/ so you can see a few folks besides me championing it.

But ultimately, you can either examine the binary yourself or else trust them.

One point of note is that it does not automatically update. Whether you install it directly or use the manager app, there is always some manual process involved in updates. (The manager just notifies you when there is an update available.)

You can't. It's some closed source blob that may very well become malware, assuming it isn't already. Use NewPipe instead

I'm a dumb dumb. Didn't realise that about the name. That's really neat

Same, I didn't get it until someone on reddit explained it to me :)