Security page points everyone to use "Report as malware" even when not malware

[miketheman]

On https://pypi.org/security/

The current guidance for folks is to use the in-app reporting for:

Valid malware reports may include examples of typo-squatting, dependency confusion, data exfiltration, obfuscation, command/control, etc.

Should we update the phrase on the button, and update other processes etc to match, or should we create a secondary notification channel for non-malware problems?