Steam is safe enough. If your anti virus program says Steam is unsafe, you should get a new one, because it means the anti virus program’s library of possible threats is stuck in the computer stone age, and it can’t possibly be a good virus program in terms of today’s standards. Sorry.
Regarding the physical copy of Train Fever, it’s still bound to Steam. Most likely due to its copy protection being Steam’s won one. I am NOT speaking for the developers, but as someone being in the business, it’s not economically feasible for most indie developers to use different copy protections. Steam is also simply the best solution for most developers in terms of pretty much everything regarding publishing.
Game engine developer wants a part of the cake, so does Steam (sales in their store and/ or copy protection), and then there’s the optional retailers who got some pretty hefty demands, not only in terms of their cut, but also in terms of sales potential, and sometimes even demanding what they qualify as a ‘publisher’.