The files it uses are mostly just the tools and shims which can be copied over from a working distribution.
The maintainer is just lazy and he doesn’t let people improve it either because he wants it to be coded in a certain way: https://github.com/ventoy/Ventoy/issues/2795#issuecomment-2326831525
It is not a malicious project, yet the xz-utils backdoor should make us be concerned, and we should only use a fork that pulls in the binaries from trusted sources.
Yet Han is still alive in Fast and Furious 9.