Security Considerations for AG vs Log Shipping
I don't know from a security point of view what might be the implications and concerns for the organisation. [sic]


Nothing changes. It's still a separate OSE (operating system environment), still only has the logins you give it, etc., the only difference is now it's using a continuous log stream and will be coupled with the cluster (so availability may be impacted, but not the system, as compared to log shipping).


  Example: in case the primary node becomes infected from some malicious software and effects the logs, what will be the implications on all the other passive nodes. 


None. We send logical changes, if those changes are corrupt or otherwise incorrect it'll be thrown out and you'll receive errors that the log stream is bad.