technically that is only true if the malware in question does something in the kernel or relies on an unimplemented wine api call, since a lot of malware is an infostealer or ransomware, its quite likely that it’ll work just fine under wine