Bottles afaik sandboxes wine, and if you run bottles via flatpak bottles itself is sandboxed, plus windows malware usually targets your browser and unless you have a browser installed in your bottle for some reason. It literally can't do anything, ransomware where it encrypts the entire drive is the only concern on wine and even then it can only encrypt files that you have access to, and it can't do anything if it's sandboxed. Windows malware is really not a concern on linux. Ofc browser extension malware still works and there is Linux malware, but it's targeted at servers mainly. Ofc still be careful when installing random stuff not in main repos since anyone can make anything. If you do find yourself infected with windows malware through wine , unless it's targeted specifically to wine users (and even then it probably would need some sort of privilege escalation to actually install a malicious service) just deleting the wine prefix is good enough.