Currently course module into text for most modules is treated as RAW (see \course\moodleform_mod.php function standard_intro_element). So, it is not filtered as untrusted content.

This leads to huge problem. User, that have editing rights (usually teacher) can catch virus on their browser. This virus appends some JS code to the end of every editor field on editing. So, editing user does not know about this problem, but infected course module intro begans showing ads or something more dangerous. So, after some time site can be blocked by antivirus for distributing adware or viruses

In our cases most code, inserted by viruses looks like

<script type="text/javascript">// <![CDATA[
...// ]]></script>
<p><iframe id="..." src="...." style="display: none;"></iframe></p>