Regarding tampering of the release files to insert malware, there are md5 and sha checksums listed at sourceforge that you can compare to the downloaded file, e.g. https://sourceforge.net/projects/civicrm/files/civicrm-stable/5.19.1/
There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use CiviProxy.
This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues.
My personal advice is ...