Yeah, it makes very little sense to “play the long game” on a private site to spread malware to a small user base when you could just go to any public tracker where it’s the Wild West. Could someone do it? Sure, but it’s really not realistic to expect that regularly.
Cycling kickstarters have an awful track record. Make sure it’s make by an actual cycling company and even then it’s better to do a late pledge after some fulfillment and reviews.