Is the payment or donation setting a scam?
Should I worry about hackers and thieves?
Maybe more context would be helpful.
How would the setting be a scam in itself? Who would be scamming whom, and by what method?
Pay what you want payment method is a favorite on itch. One could call it donation, but it is not donations as in donating to a charity. It is just a variable negative discount set by the buyer. Tipping might be a more appropriate term.
You should be wary about hackers. Both as a user and a developer. Developers get scammed all the time by scams that are not used upon normal users. See https://pbfcomics.com/comics/hacked/ for a real life example. Not a game developer, but a content creator on the net.
Scams for users vary in scope, but classical scams are rather rare, at least in gaming. Scammers want money. And selling indie games barely make money for the real developers. Also they would need to advertise, and that costs money or will be seen as spam and give attention from people that realize it is a scam and shut it down. Not that there are not enough famous scams that went on for years, with big sums, like the name giver Ponzi. But selling indie games as the scam mechanic? Nahh. They usually just try to put malware on your computer and steal and sell your data. Bonus if they get account data for valuable sites or extort money from you.
Oh, and yes, some of the scams here on itch have payment active. So you could not only fall for the malware, but also literally pay for it.
In either case, developer or user, if it looks too good to be true, pause a bit and think it over. But also be sceptical in general. There do be bad looking scams too. Remember the African Prince scams? Those were sent to small companies even before there was internet. There are even scams here in community threads. They get removed, but you might have seen some before they got removed. From badly or not at all translated advertisement to cleverly disguised sob stories. There is a non zero chance that a spammer will post in this very thread a spam message trying to lure you on a scam site.