I can't speak for steam, but I would dare to guess that most updated work is checked, also if
malicious content is uploaded to Steam servers, the company that hosts the servers weather it be steam or
a 3rd party host have at the very least scanning abilities on the server itself, I don't want to go into depth
on this but anyone who has purchased hosting for servers or websites will be familiar with why I said that.
I have used and downloaded a ton of workshop content and not once been infected, is it possible ? sure,
is it likely ? I would say No.