MicrosoftIt would take some seriously crafted malware to do that since it would have to somehow get access to 365 via the computer and then know the site etc. to login as and access the version history, assuming the user was site collection admin etc.
Pretty much all malware is going to be file system based and affect the files on machines. Which in turn syncs via OneDrive back into SharePoint. Currently that's really the only risk, so any kind of recycle bin / version history manipulation is unlikely, but when it comes to computers and software if someone has enough time and resources could eventually figure something out, but it's just as likely as some malware attacking a tape backup or backup solution etc. directly which is the same risk, but highly unlikely to happen.
