Although that's about WordPress based sites, much of it does apply. I do regularly scan the site with Sucuri's free site check, and we stay clean. I changed the adserving software due to vulnerabilities in the old software, which subjected this site to malicious code injection via the java for displaying the banners. That was a crazy three or so weeks while I tracked it down and figured out why, and then had to clean the site a few times while still using the old adserver software. We haven't had that issue since I changed the software.
This also brings up exactly WHY file uploads are limited to text files. One can insert all kinds of malicious code in macros. That's why we don't allow upload of .doc/.docx, .ods, or anything LIKE that, because of the security risk entailed with what can be inserted via a macro in a document.