Virtual Machines are not a good way to test if something has malware. Most viruses are programmed to not do anything if they detect that they're being ran in a VM.
I would add increasing the UAC or just not using an admin account, if your on windows, is also a very effective way to keep yourself safe as it will prevent a lot of malicious programs from automatically elevating their permissions.
Well, first of all you really should not be using Windows 7 anymore. For the TPB, I don't think they check the torrents, anyone can upload so it's not a trusted source. It's in the unsafe sites list on the megathread. And how would you know that you never had a malware on the TPB?
Yes and No. You should be able to set some GroupPolicies, and execute games by that type of policies like Application Guard. (Search GPO).
Application Guard is a security feature that isolates untrusted applications in a separate container, so if an attacker does manage to exploit a vulnerability, they’ll be contained and prevented from doing any further damage.
Pirated apps are one of the top source for botnet operators to infect new machines and add them to their network. Try not to run any pirated app or game if you can, but if you can't avoid it, get it from trusted sources (e.g. directly from the cracker's homepage), not from random sources like TPB where anyone can upload anything.
It's generally safe, but doesn't mean it's bulletproof as sites has been removed from the megathread in the past when they suddenly serve malwares or miners. Just use your common sense when downloading apps and games and scan them before installing.
Considering the majority of malware we have to deal with nowadays, your best defenses are:
A firewall that blocks everything by default. I use SimpleFirewall and give trust on a per executable basis.
uBlockOrigin, because dear lord navigating some sites is almost impossible without blocking all that shit
Avoid anything that asks for admin access
Keep an eye on resource usage and be on the lookout for any weird looking processes.
There was one time I downloaded a piece of shit that started to encrypt my drive. Since the CPU fan started spinning loud, I immediately checked task manager, figured what was going on and ended the malicious root process. Next, it was time to scour my folders, especially inside %appdata%, for any possible leftover executables. All clean, restart PC, everything was fine. I lost a couple of files, but nothing personal, just other downloads.