Can they screw up your MEW? Or could they possibly mess that whole one ETH account up?
I don't think this is possible. From security perspective, token airdrops are among the safest one out there, as you don't have to download any additional new and untested (and potentially dangerous) software to receive it. By tokens I mean assets created by smart contracts within some blockchain ecosystem.
But the software is not the only thing that could be comprised. For example, the website of the project could be infected as well. Or the project might require you to register an account and then take your registration information and try to log in to different exchanges, email services...
Virtual Machines aren't completely safe, and some malware could get into your system, but it does a pretty good job of letting you sleep at night and acts as a filter for preliminary problems. Good luck.
You can also use different hardware for trusted and different hardware for untrusted or less trusted software.