The lua script could be malicious but it isn't going to spread on its own like a virus. On a game like this, you are not likely at all to find actual hackers working on viruses in Lua. What you might find is the occasional script kiddie troll who thinks he is funny writing some malicious lua. Stuff like fork bombs, etc.
Still better off to tell him than not at all. I have never used a lua script, but been here for a long time. Seen people complain of getting viruses, and make viruses. If memory serves me right someone made a mod. It was a virus and the person did it intentionally. You're possibly right, but like I said, it's still better off to warn users of using lua scripts. I recommend using jacob1's lua scripts.
I think it's both errors in code and people being dishonest about their intentions. Sometimes the person or persons don't mean it, but like I said their are devious people out there.