We had that, almost a decade ago.

The cause was that the site was in fact compromised and at a certain very discreet URL it hosted a bunch of pages for legit products that linked to external shady sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.

The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.

I mean sure that makes sense - but the OP isn’t even getting any information to confirm or deny this. If that’s the case Google should explain the issue.