Curse is owned by Twitch, which is owned by Amazon. That’s about as legitimate as you can getimate.
You can also use Planet Minecraft, but that website can use external download links so you might have to be careful. If you’re worried then avoid redirect links like Adfly and only use links that let you see the full URL.
Downloading Malwarebytes isn’t a bad idea. It doesn’t make you immune against malware, but it helps.