P2P releases can come from anywhere. If you are worried about viruses and malware, it’s probably best to avoid them even though the danger is still very low.
Scene releases are almost always purchased legitimately by the group for cracking. The most popular repackers usually use scene releases as their source.
My experience with Linux is very limited other than my steam deck. For cracked games, if there is no Linux version available, I usually install them on my windows pc first, copy the games folder to the deck then add it to the library as a non steam game. After that you just specify the proton version in the games steam properties and it runs.
Ideally you would want native Linux versions. Those are few and far between but they do get released from time to time.
I’ve never paid for a private tracker but users can donate if they want. Like I said, I have a firm belief that piracy should be free. Never paid for it, never will. A good tracker with top site bots and well seeded torrents is good enough for me. Releases are on there within minutes, download speeds that max out my connection are good enough for me.
All the private trackers I use have bonus systems so you can still build ratio. It’s usually a slow start on a new tracker but once you get established it’s very easy to keep a 1:1 or better ratio. I don’t bother with debrid services because paying for piracy is where I draw the line.
As for checking hashes, I don’t do it on any of the private trackers I use but OP seems overly paranoid so I figured it was solid advice for them. I always checked when I still used public trackers. Only twice did I ever find a mismatch, one was actually malicious and the other was just a random crc error.
You don’t want to know how much that would cost in Ontario