You don’t need to worry about malware because Sculpt is not widely used so nobody will have bothered making such for it yet.
I do not think you have to worry if you are not in the habit of leaving the laptop lying about. I am - as with some others here - also a follower of Haiku and we often have these discussions in that project’s forum. Whilst Haiku is also not a popular target for malware, if you want something rock solid for state secrets and the like, then we openly say Haiku is not for you. In terms of resistance to being hacked from afar, and also ability to lock the machine when you step away from it, Sculpt will be streets ahead of Haiku. This means anyone targeting you will need a plot to physically get hold of your laptop. It is good that you are considering this occurrence, but is it likely that anyone is going to steal your laptop for this end?
I apologize if I seem a bit complacent, but as the Haiku community often point out, every two-bit outfit tracks everything we do online nowadays, and somebody would have to be of special interest to justify the more bespoke “spy thriller” types of hacking and espionage.