First, many of The Black Hats that delight in inflicting Bad Things on us aren't targeting any of us specifically, so being an "average Joe" doesn't necessarily protect us. Many of the attacks that have been launched were done with the specific intent of "acquiring" machines that could be remote-controlled ("bot nets") for later use such as DDoS attacks. For those, "they" mostly don't care who they manage to acquire.
Granted, using something like Ren'py as a vector may not have occurred to many of the Black Hats, but if it did, and they decided to infect something popular like, say, Summertime Saga or DMD, they'd probably be able to get to quite a few people.
True, but don't over worry about them. Botnet owners seek for discretion, they will most likely come from the outside than from the inside. What they want is a totally lax user ; the kind that assume that "it's normal", if something odd happen, whatever this thing.
For them, using a virus is counter-productive, especially if it's one widely spread. It will be intercepted soon or later, which will cost them part of their botnet ; a botnet that will not be able to make grow again before some times. Not because the virus would be intercepted, but because the lab(s) that will have it, will put it in a sandbox, then let the computer be corrupted, to later be able to study the tools themselves.
They also are more likely to corrupt a game that is way less successful. If Summertime Saga or DmD where corrupted, I'm pretty sure that it wouldn't need more that a week before all anti-virus labs were aware of this. Writing a virus is relatively easy, but writing the structure for a botnet is something totally different, and they would have to change it radically enough if their tools were part of the database of an anti-virus. Plus, they generally use zero day exploit, that they want to keep for them. Pointing the light on their infection vector would cost them a lot of time and money.
What is to fear is more the ones that steal credit cards number. Those would target big games, because they're fishing with explosives. It's more or less like a Nigerian scam, they spread thousand of fishing hook in the hope to have two/three fishes at the end of the day.
There's also those who will use your computer as light SMTP host for their spam, or light HTTP server for their fishing campaign. But, having left the field too long ago, and seeing how lax nowadays admins can be, I'm not sure if it's still a thing.
Second, if you take the Ren'py case, in general antivirus scanners are most likely to look at the .exe file (to use the Windows example) that comes with a game.
They do more than this, and I don't talk about their behavior scanner.
When I changed my computer, I used my LAN to transfer part of my files. And my anti-virus remembered me about my collection of Perl and Vscript exploits ; most of them being in txt or msg file, since they were directly coming from old mailing lists and/or specialized sites.
It doesn't mean that you're totally protected, but generally if it's in an archive, you're safe even if it's not explicitly an executable.
We should probably thanks the many exploits in the archive tools that, time to time, have permit to change the extension during decompression and/or to execute whatever was stored inside. As well than the JPEG virus I was talking about, that clearly revealed that it's not just executable and documents embedding macros that are at risk.
[...] to get on the AV companys' radars, particularly the additional work that would be required.
How many Ren'py game is there now on Steam ? They surely never deeply studied the engine, but they probably know that it exist, where to find it if needed, and that it rely on a text-like format and two pickles variations.
Anyway, while they run many sandboxes to catch the viruses, they also rely on the help of the community. They all have a way for us to submit them suspect files (just ask google how to "submit suspected virus"), and they study them all. So, if they don't catch the virus by themselves, it would be you, me, or someone else that will point it to them.
In any event, my own judgment is that the risk of this kind of thing is not high, but obviously it's not zero. So (personally) I take a few extra levels of defense.
It's always a good thing to do. I mean, my network related programs run inside sandboxie, I have an IP filter on my computers and one on front of the LAN, plus all HTTP traffic pass through a filtering proxy, so I'll not be the one to blame someone because he have too much safeties.
But what I was saying is more that by being an average Joe, your risk to be targeted by totally unknown malicious code is near to 0. There's stealth code, there's exploits used since long that are still unknown from the community. But their value is way too high for them to be used on small targets and/or spread widely. What we can encounter is basic attacks, and 99,9% of the time basic counter measures are enough for this.
.
