Slashing will be fully enforced soon. Both, validators and their delegators can then be subject to slashing. Malicious behavior (e.g. signing two blocks at the same time) will be punished with a 100% slash. Poor performance (e.g. being offline for +24h) is punished with a bounty reduction. In case of a severe slashing event, the funds are placed in an ESCROW and "an analysis will be done on whether the validator indeed attempted to act maliciously or if it’s a code issue. If there is no malicious behavior found by the community representatives, delegated tokens will be refunded." (Source)
Therefore, we advice you to carefully choose your validator. Please note, that the costs for running a secure and professional validator need to be covered by the commission rate. Hence, it is worthwhile to accept a certain amount of commission in order to secure your profits and minimize the risk of punishment.