Many "PKG download" sites are honeypots. The file you download might be a .exe disguised as a PKG (Windows malware) or a script that infects your PC when extracting. Reddit r/Piracy and r/PS4homebrew are filled with warnings about fake 40GB downloads that crash or contain miners.

Most people ignore the risks. Here is what actually happens when you search for "Ghost Of Tsushima Director's Cut Ps4 Pkg Download":

Beyond the risks, pirated versions lack essential features of the legitimate experience: