Mods are package based content. What's inside the package could be simple xml tuning or compiled code, but even with the code that Script and Core Mods run none of it can really reach outside of the TS3 user game folder. The mods are like plug-ins for the game and can only do anything in the environment that the game provides for them. There is no possibility that a mod, meaning the standard kind that goes into Mods\Packages within the user game folder, can affect the game's installation files nor can they change "other code on your machine." I think that the guru above was taking things a bit out of context in an attempt to simplify the questions they may have been addressing.
Certainly a poorly made, outdated, or conflicting mod can damage an ongoing game save or even the entire TS user game folder in some extreme cases. But that's as far as the damage can really go and is why we always advise backup copies of game saves and user game folders for those who like to continually add new mods to their games, thus providing safe points of retreat should things go wrong and to help avoid total ongoing game save loss and wastes of time.
Now what can happen is that mods can be bundled up with malware or other unwanted things in such a way that the download or whatever mechanism the developer provides to deliver them can do much more damage than just to game saves and user added folders. We would call that a "trojan horse," something that is coming along for the ride that is not what the player expected or is beyond that which was promised to them. Anyone who really has suffered damage to their operating system or has had to reinstall their entire game because of a "bad" mod download would have fallen victim to such malware, but it's not really the mods themselves running within the game environment that have the power to do these things. Reputable mod developers do not let these things happen, but it becomes up to the user to ensure they are getting their game content from safe places, that their web browsers are not compromised thus delivering things they never wanted nor asked for, and that they aren't clicking on or activating phony ads that may show up pretending to be the intended download targets.
