only if they install api on their theme, or obfuscator.. usually, wordpress theme and plugin fall on GPL which is General Public License and its a public domain so you free to use them, some of them are not gpl, so it depends on the theme you try to use on your web
one way to make sure your website is safe is to use antivirus plugin, like defender