I've heard that NeoEE is flagged a virus by either Malwarebytes or Kaspersky. I am a bit paranoid. What about gameranger?
Also, what's the best unofficial patch for EE?

You're asking as if there was a choice. You either use NeoEE or you can forget about the built-in Multiplayer.

Kaspersky is a virus and spyware itself, so I wouldn't care about what it shows.
For Malwarebytes it's good to check the threat name. They usually even flag programs that insert serial keys, so it's good to analyze what it detected. Since Malwarebytes became a paid subscription program, in my opinion it started throwing too many false positives, to keep users. It basically triggers for everything unknown (low reputation), and they mostly determine if program is safe or not, based on the number of users that have it installed.

Gameranger itself for a long time required installing the unsupported flash player on users computers, just to display the ads. Can it be considered as a safe program them? I would say it's less risky to use some fan-made patch with multilayer, than a popular program with potentially dozens of backdoors which can be used due to its popularity.

If you're paranoid then don't use any of these, until you find open source alternatives.

Depends who you want to play with. If just some friends, I would go for a virtual private network emulator and once you are all on the same network as each other, just play LAN (Local Area Network).

Game Ranger has been fine for me too.