> so 1% seems reachable without considerable malware problem

Another plausible explanation is that pure FLOSS repos are free fron malware.