I would lean toward dropping rather than bouncing spam/malware/phishing, just because the system on the other end might misclassify groups.io as the source of the malware.

If you do bounce it for malware, whatever triggered the malware alert (attachment or link to dangerous site) should be stripped from the bounce message to avoid this.

JohnF