The simple answer is YES and any website can be hacked. Nulled and GPL themes/scripts are not from original developer so there is a posibilty that some individual has inserted a malware or any backdoor script in it.
The solution to that problem is easy. just go to this
virus total website and upload your theme/plugin. you will get the results if there is anything malicious in that file. if even single result is red, dont use that theme/plugin.
I hope, your question is answered.
