Is there the possibility that an add-on could delete data from your device? I would have thought so (I've not checked whether Kodi creates an environment that means only data created by an add-on can be processed with a delete request, but I suspect the checks might not be there). However I've not yet come across any horror stories about it.
The add-ons we put in our Wizard are tested for a while before going in the normal packs, but if you ever want to report strange behaviour, please do feel free to post about it here and in the add-on author's forum, if they have one.
Have a quick search around in these forums, I think antivirus apps have been discussed a few times. Some people use them, others cross their fingers.