Confusion in understanding data fork, resource fork and the MachO file format when viewed all together
The ._filename file does not only contain the resource fork, it also contains Finder metadata, in AppleDouble format.

The resource fork itself can be viewed on an HFS volume by opening filename/..namedfork/rsrc. Forks and other extended attributes can be listed by using ls -l@.

Resource forks are not specific to the Mach-O format (and I do not know if they are used at all for it), they're a feature from classic Mac OS which was extensively used for classic application files, and could store things like string tables, bitmap images, etc.

Malicious code can be hidden anywhere, a virus scanner should be able to detect it even if it is hidden in a resource fork.