We had that, almost a decade ago.

The cause was that the site was in fact compromised and at a certain URL it hosted a bunch of pages for various legit products that linked to external scam sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.

The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.