It should be noted that the malware bundling was done when SourceForge was owned by DHI Group, Inc. And now, for many years already, SourceForge has switched owners (BIZX/Slashdot). They have undone the bundling and are now trying to manage it like it was managed before. It seems like it's going well.
I would consider SF a viable Github alternative, but the bad reputation caused by a temporary owner just seems to stick forever.
The Sourceforge UI and overall experience is still a decade or more behind the experience on GitHub and most of the other modern and maintained equivalent sites/services like Fossil, GitLab, Gitea, etc
That ancient feeling UI doesn’t win them a lot of forgiveness, if the only notable change has been “we took away the malware” and the site continues to remain stagnant, SourceForge will continue to feel very inferior to more modern alternatives.
SF's development was also essentially stalled during that period, and the current owner has to do much more things other than (proper) management to cope with competitors. If you need a proof, compare SF with Gitea/Forgejo.
I would consider SF a viable Github alternative, but the bad reputation caused by a temporary owner just seems to stick forever.