After a bit more research:
Only if you download, install and activate a malware infested widget. Much like software in general, in fact.

It's probably better for a user to download a widget than it is for them to download a random bit of desktop software, as widgets are more restricted than, say, java applications or generic malware infested freebie software installers.