Can viruses in (Primary or Secondary) user profiles on Android affect other users? This says:
"Any user can affect the installed apps for all users."

What does this mean?

I was concerned as to whether malware or any account from one user could affect anything from the other user. The previous statement: "No user has access to the app data of another user." seems to contradict this. In that a virus or other malicious application cannot affect the app data of another user. But if any user can install any application on all users, wouldn't this pose a security risk?

This seems to be contradicted by the fact that on a secondary user profile, when I go to Settings > Apps I can only see the apps for this secondary user. I cannot see any app that I installed on the primary user. 

On the Primary user profile, when I navigate to "/storage/emulated", I cannot see any folders at all, let alone the one for this user profile (I think this is where user profiles are stored). This suggests that the contents of the Secondary user profile are not viewable by the Primary User Profile. 

If you want to know what a Primary or Secondary profile is, refer to the link under "User types".
What meant here is. If the malware has installed itself as an application in system. It will affect the phone cross-users irrespectively. For a user installed app that contains malware also, it can affect users systemwide if the two users install the same application since Android shares the installation directory /data/app and the obb data at /sdcard/Android/obb/ which initially on a new user isn't visible but turns visible on install of any app that utilizes obb files. The application data files at /sdcard/Android/data are not mutual across users though. Remember a file to be a malware it must be a file that can be executed by phone. So files of media, pictures, text based files can't be malware in any way. That's why I have emphasized about an app. A file to be a malware should be at:

/data/app


If it's a user installed app

/system/app
/system/priv-app


If it's a system app

/system/bin
/system/xbin


If it's an auto-executing system binary

/system/framework


If it is a framework that is being used by system or third party app to render UI of ads or drawing over the system(adware) and installing apps without prompting(bloatware).

/system/vendor/app


If it's a system user app.

Alternatively an app can create it's own space in system where it has heaped binaries, libraries, frameworks and shell scripts used to initialize it's services in system.

A user can only be safe if he installs apps that the other user hasn't installed.