Ideally, a .mp4, or any other non-executable file format, would not be able to execute rogue code on your computer, but the programs you use to open the files with might have security flaws which allow rogue code execution if done right.
You might have a hypothetical file, which might not be dangerous if opened with VLC, but which exploits a flaw in, say, Windows Media Player version x.y.z to execute a payload.
Sorry, for not including any examples, I'm currently not at the PC.
What really sets the Steam Controller (and the Steam Deck's control layout) apart from the market are the dual touchpads and dynamically/easily programmable buttons. The above just looks like a reskinned XBox controller, and, if I read the article right, it needs a "companion app" to get full functionality out of the controller.
I hope that they at least made sure that the companion app works on the Steam Deck.