If you remove the Deco M5 and just connect to your main modem, do those malicious files appear?
Our deco network are safe so far. What malware you get? I may also keep an eye on it.

I have always expected that the malware protection is based on network addresses, not content - that the Deco is supposed to block connections to Internet servers that were found to serve malware. Since the Deco cannot read encrypted traffic, it can't protect you from, say, malware hosted on an https web server that hasn't already been identified as dangerous. Deco isn't a complete malware solution but it should make your network safer than a "dumb" AP. For additional protection you might want to configure your Deco to use a filtering DNS provider like https://www.quad9.net/ although those services have the same limitations.