Well, they say that development for these phones is mostly dead.
Also, I do think that getting a virus by simply downloading Android ROMs from some unknown source (or an open source project maintained only by 1 person) would be quite easy. Not to mention that xz-utils, an open-source project was recently backdoor-ed.