If you wanted to work at it. If you really tried hard to setup a VM, disabled every basic, built-in security precaution that the VM provides, enable every single data sharing service that the VM allows, disabled all security protections inside the guest OS, manually downloaded all the malware-laden pirate apps and "video codecs" that you can find, then yes, you might be able to get some PC malware files on your Mac. Of course, they will be completely, absolutely harmless. But better be on the safe side and buy yourself 2 or 3 3rd party antivirus apps. You need them for both the Mac side and the guest OS side. So I guess that's 4 or 5 separate antivirus apps. Let's see, at $44.95/month, that will cost you about $180/month for malware protection, plus tax. Can you ever be too safe?