For now, at least. Google *is* working on RISC-V in Android.

So once that lands, there is a bit of an attack vector, thus I wouldn't be surprised about malware in the future.

But untill then? Smooth sailing =)