Please note that EV Play was built to be tinkered with, and thus is a rooted -- "jailbroken" for you iPhone users -- device. "With great power comes great responsibility" as they say, and just like any computer, I urge you not to store sensitive information on EV Play. That means non-encrypted passwords, financial information, and anything else you don't want landing in the wrong hands.
With that said, there are a few differences between say a computer, which is always connected directly to the Internet via a dedicated or semi-dedicated IP address, and EV Play, which is not always connected to the Internet and which has a constantly changing IP address via a mobile carrier. And while that makes hacking it a bit more difficult, it doesn't mean much if you download a bad app and it wreaks havoc on your system. And so if you do plan on regularly using the Android side of things, I highly recommend installing virus protection software. I like Avast, BitDefender, and AVG.
If you just use Android Auto/CarPlay and don't plan on using the Android side of EV Play, and keep your WiFi connection turned off, then you have very little to worry about. CarPlay/Android Auto viruses are extremely rare. Not impossible, but extremely rare.