Having a closed source backend isn’t the reason for malicious packages. There’s a clear distinction between official and unofficial packages, and flathub isn’t immune to this either.
In comparison to flatpak, each runtime (core[number]) is supported for 10 years, so developers aren’t pressured to update it if the app keeps working. The side effect is that over time you will end up with a few extra core snaps on your system but the peace of mind for the maintainers is worth it imo.
On a technical level, they’ve gotten very capable and in some ways are better than flatpak (packaging CLI software is super easy). Yes in the beginning they were slow but 10 years has passed.
What a lot of users dislike is Canonical not open sourcing the backend that hosts the files. You can always install them locally, similarly to apks on Android. I don’t see it as an issue because once the parent company/organisation dies that’s usually it for the project, be it open source or proprietary.
Snaps also use runtimes based on Ubuntu itself so Canonical dying = losing core functionality that is open source but nobody else will bother to take on that job.