I tend to believe Google more because there was no source code, nor audit and no one really decompiled it and inspected it. Like in most cases people are like sheep and do what others do, blindly installing and following it …

It also depends on your definition of malware, tampering with adb and some root commands not necessarily means malware behavior even if you are not aware of it, because there might be no other way to approach it. From what I saw so far there was no dubios data transmission or no android file system altering that harms the file system or user data itself… but it still executed functions with higher privileges in the background, so it depends on the definition…