It works really well unfortunately. I would prefer my installations without the potential for malware, but I don't see another sftp client as mature as filezilla. There used to be a ton and then it emerged as the best. fwiw it seems the auto updates are malware free.
I always install FileZilla through Ninite or apt-get, so I know my installation is clean, but I'd like to stop using and recommending FileZilla out of principle because of this (and reading the responses on the filezilla forum). Everyone else in my office uses FileZilla as well, and I'm sure many of them used the sourceforge installer and didn't fully read the options.
But you're right, I don't know any other decent FTP clients that I would recommend. Maybe someone on HN knows of a good alternative?
WinSCP is far superior to filezilla. At my last job stuck using a Windows machine for some things, I ended up using it quite extensively. Every bug I submitted to the author was fixed within months. He is also active on the forums, though has a bit of a Linus Torvalds style... which can be offputting for some.
Filezilla use will drop down because most admins I know that hear about this will immediately write it off as too dangerous to even try to get around. Sure you can dig into the sourceforge files and maybe find a clean version, or maybe find a checksumed mirror, but would you really trust it?