Highly likely, actually. SteamOS is Arch-based, and if a user installs things through the AUR on their deck (like a password manager or a VPN that isn’t part of the official upstream repo), then it would be infected exactly the same as any other Arch-derived OS.