I can't remember all the details but it's not so much the developer but rather rumors being that it's potentially malware, issues with the AUR version in the same regard, concerns about certain lines of code, etc, etc, etc. nothing really defacto proven but "worries" about it.

I personally have never had issues with ventoy and i've been using it for years.