I'd argue that power is more the issue. All that processor time the antivirus spends scanning and rescanning is a chunk of battery gone.

From a theft perspective, being able to hijack someones steam account is likely to be more lucrative than most. There's a window where they might be able to resell the account to someone who doesn't know how easily valve can verify true ownership and fix it.

You've still got a lot of botnets and cryptocurrency miners flying around. Ransomware is the big one that targets people with important data that a gaming device is immune to.

Anything with an IP address can be vulnerable to malware running miners, botnets, and all that good stuff for bad people to continually use your toys to do in the background. The convenient jumping off point into your home network and other inward-facing stuff there you might not want accessible from outside is also worth considering.

There's still ransomware. Pay X bitcoin or say adyeu to your encrypted savegames.

That's not how most malware works though. It's pretty rare that it's targeted rather than something just looking to take advantage of whatever security hole is present.

Like, I highly doubt anyone is making Steam OS specific malware, but if there's some security hole in the kernel, a piece of malware targeting that isn't going to check if it's a handheld gaming device and stop.