Free themes distributed by the official WordPress.org Theme Directory are safe due to their reviewing policy. A theme cannot be released or updated without going through a detailed and thorough manual code review (combined with a few additional automated steps).
The free directory is also quite limiting in terms of features. Themes are only meant to be used for presentation purposes – everything else is plugin territory. That’s common sense but premium theme markets have been trying to change the rules of the game. Therefore, themes listed in the directory are fairly simple as well, which makes them somewhat safe and pretty lightweight as a starting point.
Free themes from other sources (random online sites and blogs) could contain whatever (they decide) – including different forms of malware. They are probably free – but the author may also use them for a spam network or a channel for ad distribution.
Premium themes that you happen to find at no cost online are most likely (I’d say 95%+) injected with various forms of malware. Not only is piracy wrong but it’s outright dangerous for your site as well.
