Are AppImages a generel security risk?

As far as I can tell, no Cryptomator does not use fuse2 on Linux, and requires fuse3 instead.

Reference: Volume Types | Cryptomator Documentation

Linux-Based OS

FUSE

Requirements: Linux, fuse3 installed

FUSE on Linux works only if the fuse3 package is installed. Luckily, fuse3 comes pre-installed on many Linux distributions.

Note: this requirement is separate from the appimage requirement for fuse2 to be installed.