Can a Chromecast be infected with malware and spread it?

Dear all

I have always considered open networks without password insecure.

When a Chromecast device is not connected to a wifi network, it creates its own wireless network.

The scenario:
There is no other router, network, wifi etc.

The Chromecast creates a wireless network.

There is no password on the Chromecasts wireless network – anyone within range can see and access it.

Hacker connects to Chromecats wireless network >
Hacker infects the Chromecast with malware >
Device X connects to Chromecast wireless network >
The malware on the Chromecast infects device X

Is this possible?
Or is this purely theoretical / NSA-level stuff?

Thank you