It's a full-blown OS running sandboxed apps. Just like iPhone and iPad.
Anybody ever heard of an iOS virus? On a non-jailbroken device?
If you mean self replicating and spreading malware (what I refer to as a virus), I don't think so. Not without a jailbreak anyway.
However there has been successful injections of malware via an infected PC then through the USB when the iPhone is connected. Basically forcefully side loading a malicious app. Without Google searching I'm fairly confident one was called Wirelurker and would only work in China (I think, might be a different country). Side loading still easily possible on the ATV? I know people were side loading emulators when the ATV4 first released.
Like you mentioned because of sand boxing the malware wasn't too harmful. I think it would phish and push ads or something.
However on Jailbroken iPhones it could reek havoc by targeting financial type apps.
Don't keep passwords in plain text on your phone though regardless. A jailbreak itself is the result of multiple exploits in iOS.
I too find it incredibly unlikely that malware could get onto an AppleTV or be especially harmful even if it did. However its still best to keep an open mind about it. If state funded malware can jump a air gap and literally blow up nuclear centrifuges then we shouldn't just drop our guard and say its impossible for malicious software to get onto an AppleTV. Especially considering an ATV can be a hub for home automation could make it a valuable target for someone.
(adjust tinfoil hat)