A theme contains PHP files that execute on every page load, including a functions file that can add features much like a plugin. A vulnerable or tampered theme is therefore as serious as a vulnerable plugin.
Themes are often forgotten because they appear to be only about design. Unused themes still sit on disk, may still be requested directly, and may never receive updates. Premium themes sometimes update through the vendor rather than through WordPress.org, so check how each one is maintained.
Use a child theme for customizations, keep one maintained default theme as a fallback, delete themes you do not need, and review theme files when investigating a suspected compromise.