Can viruses in (Primary or Secondary) user profiles on Android affect other users?
What meant here is. If the malware has installed itself as an application in system. It will affect the phone cross-users irrespectively. For a user installed app that contains malware also, it can affect users systemwide if the two users install the same application since Android shares the installation directory /data/app and the obb data at /sdcard/Android/obb/ which initially on a new user isn't visible but turns visible on install of any app that utilizes obb files. The application data files at /sdcard/Android/data are not mutual across users though. Remember a file to be a malware it must be a file that can be executed by phone. So files of media, pictures, text based files can't be malware in any way. That's why I have emphasized about an app. A file to be a malware should be at:

/data/app


If it's a user installed app

/system/app
/system/priv-app


If it's a system app

/system/bin
/system/xbin


If it's an auto-executing system binary

/system/framework


If it is a framework that is being used by system or third party app to render UI of ads or drawing over the system(adware) and installing apps without prompting(bloatware).

/system/vendor/app


If it's a system user app.

Alternatively an app can create it's own space in system where it has heaped binaries, libraries, frameworks and shell scripts used to initialize it's services in system.

A user can only be safe if he installs apps that the other user hasn't installed.