Is the arduino hackable when using communication shields?
You should be pretty safe, at least as long as your code handles the
incoming data properly.

When you upload a new sketch through USB, the USB-to-serial interface
uses the Arduino pins TX0, RX0 and RESET. Your Ethernet shield, on
the other hand, does not control the RESET pin. Pulling the RESET pin
LOW is needed to make the processor enter the bootloader, which in turn
is needed in order to upload a new program. For pulling this pin low,
the malicious code would need not only to break into the Ethernet
shield's firmware, it would also need a hardware hack to access the
pin.

Now, if your own code is not safe, it is conceivable that the malicious
payload tricks your program into jumping to the bootloader or, as
suggesting by Juraj, into triggering a watchdog reset (which ends up
being equivalent). Thus you should treat anything coming from the
network as potentially malicious.