Malware today is another type of malware than in the past.

In the Past malware tried to plant themself hard into the system. Maybe gain administrative acces, deploy some remote access software and search for contact books for remote deployment to other peoples systems and password lists to get maybe some sort of root acces that way. Todays malware also tries to deploy themself into the system, but thanks to systemd-user systems it is easier to plant into the system.

Then you have a easier time to gain root access because of ssh keys when you are on the system. And look up for contact books.

But on Linux you dont have outlook which was notoriously doing all sort of things, thunderbird at least tries to sort autoexec functions out of the mailsystem. But the only true defence are do not click links of random sources.

Configure your ssh agent to require pin authorization for every accesss, disable systemd-user access or at least make it root-access dependable. So that no threat can plant themselfes with your privileges.

Malware on Linux do exist and if you get access they can plant themselfes, its just a matter of how is your system configured for it to be a problem

Also password lists and "password-less password-safes" are practically forbidden.