The best defence against malicious messages and spam is both to just to avoid displaying human readable information sourced from untrusted sources.
Perhaps giving the user the ability to add simple regex plugins that could parse certain OP_RETURN transactions in their wallet and display relevant info would be a safe and useful feature.
Or just disable such feature by default and make it's a bit difficult to enable the feature (e.g. must be enabled from manually created config file or the application must be started with specific parameter).
I doubt regular users would bother do that just to see OP_RETURN data.