This seems like a one off for them, but for me whenever tracking ongoing TV series I would regularly get malicious files as they appear before the real ones, and get found and downloaded by sonarr.

These days I only automate from private trackers, and enable a public tracker for an interactive search only if something can’t be found on the private trackers.