I think the biggest risk now is supply chain poisoning, where a system update or package installation runs executable code alongside it that can be malicious, as most supply chains for Linux distros don’t have automatic security checks in place but rather rely on the security of the identity of the package maintainer. If their setup gets compromised that’s the bigger risk rather than the traditional “virus” like you said