On servers couldn't somebody write a "virus" using this card to grab files off the user's computer?

The phrasing of your question is unclear, but if you are concerned about the server host I assume there is no way to access arbitrary files, everything lives in a little bubble the mod creates. But if you are talking about the computers in the game, then yes, it is possible to copy files. Why would this be a problem? The ability to copy files is important.

Could you elaborate on how you expect this could be exploited? Since clients have to a) interact with a computer for the card to do something b) select a file to load/path to save to, I don't see how this would be a security concern?

I looked a bit further into further, I was under the assumption there was an API to manually get files and that. my bad I will need to actually do more research next time!

All good, thanks for being mindful of the security aspect of things, It's appreciated :)