Yeah, those are just false-positives, they think they are suspicious or malicious, but they are not. VirusTotal uses 70+ scanners to check the URL or file. The best way to think about it is that since the majority of the scans show it as clean, it is most likely to be safe. If there are several scans showing it as malicious, it probably has something that isn’t safe.
Long story short, in a limited way.
If you look at the protocols available, there are two, BT and μTP.
BT needs one of two peers to have a port open to connect to, either they initiate the connection, or you initiate connection. So if you want to download Arch Linux 2024.12.01(magnet:?xt=urn:btih:265863cbbb5ed9ef39e7c891ebebdf1623b09d5e&dn=archlinux-2024.12.01-x86_64.iso), you’ll need to either connect to a seeder that has a port open, or if you have a port open the seeder can connect to you.
μTP can solve this by performing NAT traversal using UDP hole punching. The way this works is a third peer with open ports will relay information for both peers with closed ports to connect to each other.