If such a project were to become compromised (the way XZ-Utils was), it would eventually spread to Ventoy.
What a lot of people don't know is that the XZ attack entirely relied on binary blobs: Partially in the repo as binary test files, and partially in only the github release (binary).
If someone actually built it from source, they weren't vulnerable. So contrary to some, it wasn't a vulnerability that was in plain view that somehow passed volunteer review.
This is why allowing binary data in open-source repos should be heavily frowned upon.
Simple solution is to use
cryptsetup
to encrypt it, forget the key, and optionally overwrite the first megabyte or so of the disk (where the LUKS header is).