yt-dlp is legit. It's a fork of the yt-dl project, adding in a few extra features. yt-dl itself is used in a number of open-source projects like NewPipe.

yt-dlp is also an open-source project, with its source code available on GitHub for everyone to scrutinise. If it had malware bundled in it, it would have been easily identified by users.

You can try a GUI for yt-dlp here. I only use the command-line version so I won't be of much help with it, but lmk if you run into any trouble.

You could alternatively use Jdownloader2. It's an amazing all-in-one downloader. Just copy the link of the YouTube video, and it'll automatically pick up the video you'd like to download. You can change the quality of the video to download and even download the subtitles, thumbnail and description too. For music, you can choose to only keep the audio track in the m4a, opus or ogg format. Here's a video guide to get it installed and running.