It depends if the TLD registry is reputable organization. Obviously Verisign (.com, .net), PIR (.org) or Google (.app) seem to be more reputable than Indian Oce

It depends if the TLD registry is reputable organization. Obviously Verisign (.com, .net), PIR (.org) or Google (.app) seem to be more reputable than Indian Ocean Territory (.io) or Montenegro (.me). But there is a bunch of other ccTLDs I wouldn't be afraid of, namely .co.uk, .eu, .de, .nl, .se, .cz, .no and many others. It always depends on the particular organization and its rules and security policy.