My understanding is that lots of the malware is handled via windows patching.  We apply patches on a periodic basis (I think it's quarterly).  Also, we keep an eye out on the Tableau security bulletins which can be found here.  Security Bulletins

Security should have a multi-prong approach. Anti-virus exclusion is a must or your performance will suffer greatly. How about make sure external data sources are scanned regularly? Add adequate access control on Tableau's server box and timely Windows patching etc. should minimize security issues.