Building a USB 3.0 host device
For the  software, I definitely think that Linux would be the way to go. The reasons I would choose it over android are threefold:


Linux has a much easier way of handling file systems than Android. It was built as a server operating system, as opposed to android which was built to run on phones and tablets, so is less file-oriented, despite essentially being a Linux distro at its core.
There are many platforms running Linux that you could use for a base. Embedded Linux devices are everywhere, whereas android devices are few and far between. I would heartily recommend starting with one of these platforms, as they will help get this off the ground much faster. 
Yes, you are correct about Linux being less prone to viruses.


The GUI problem is a major consideration. However, you are in luck. If you (or someone in your team) is familiar with C, writing a GUI in GTK+ would be the easy way out. This requires installing a bit more software (X, GNOME) than is ideal for an embedded platform, but all things considered I think it is the best way.

Hope this helps!