Elsewhere in the manual it seems to imply that formulas can include arbitrary Emacs Lisp functions, which would make it quite easy to implement a virus as there appears to be no sandboxing. What it probably means is that viruses written for other spreadsheet implementations won't work on it.

Edit: never mind; I read further and it does do some sandboxing based on the same whitelisting principles as directory-local variable settings. Very clever.