So far, no one has the technical skill to embed a DS trojan into a commercial ROM. When you run DS homebrew, just make sure that other people have done it.
DSOrganize, for example. If many many people have used it and love it, there chances of it being viral if you download it from the official site are about 0%.
Nothing's stopping anyone from making another DS trojan. However, they would be caught very quickly, as the first person who gets hit would make a big deal out of it.
darkfader's (or was it natrium47's?) romloader is an exception because there was a huge demand for it. Once it was released, everyone said "darkfader!?" "ROMLOADER!?" SURELY I MUST RUN THIS NOW RATHER THAN WAIT TO HEAR IF IT WORKS!
edit: Yes, norton picks up on both DS trojans iirc.