That is to be expected by a project that contains encryption code, I'd say. Maybe their userbase isn’t big enough to report all false-positives and gain the reputation needed.

It could also be that some ransomware crap has used their codebase as a foundation for their system and then it gets flagged.

It's a very very common problem in the Demoscene, demoscene authors striving to impress in the 64k category created better generic EXE compressors to shrink more content into their 64k binaries, just when any tool is publicly released it is almost immediately flagged by AV software since virus makers scour our forums knowing that once in a while a useful tool comes to hide their malicious code.

Just as a rule of thumb, doesn't the fact that only a few unknown vendors flag it—and all of the major vendors do not—indicate something? It would suggest a false positive, wouldn't it?

When I checked a few years back, even a ”hello world” Go application compiled for Windows was flagged as malware by a malware scanner that I investigated.

I’m not at a computer where I could try that hypothesis right now, but back then my conclusion after testing various executables was that any unsigned Go binary would be flagged as a malware.

I'm concerned about your comment.

I envision a future when people can't deduct anything by themselves and will rely on automated, flawed systems.

The problem is not knowing why and how the systems are flawed, and therefore being unable to have nuanced and truly accurate decisions.