This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.