Well... sure, Haiku could run viruses but... why? What would be the point of such an exercise? For instance, one could form a virus in C++ or bash, but why?
While Haiku isn't secure by any means (I.e. no ASLR I'm aware of, no firewall, no antivirus, etc.), Haiku does have a read-only FS and supports snapshots that somewhat help with this. But again, why? Haiku is small and doesn't have much to gain by doing that. If you know of an exploit or hole, the ethical thing to do would be to contact the developer team and let them know about it.
Expand-o-Matic supports several formats, including, I believe, 7-Zip. As for rar, I'm not certain. Your best bet would be to look in the Depot for yourself if it doesn't. As for Word XML documents, for now, I would use Google Docs in Web+ or a good browser as Haiku really doesn't have a good, solid office suite yet. KeePass is not supported.
I'm sure others have better responses than I just gave, but that should help answer your question.