Sorry, I know this is nit-picking, but a "virus" is a specific type of malware, a program that can copy and propagate itself to other devices, and there are no android viruses in the wild. There is malware, but it relies on the user installing it; usually as a "trojan", i.e. a legitimate-looking app with malware hidden inside it, or sometimes a scam like a fake warning message to scare them into installing a fix (which is really malware). I'm really saying this because the word "virus" could be misleading to someone who knows a little about computer security but not much about Android, and it's better if people understand what the real malware risks are.
What root does is it allows the user to grant administrator/superuser privileges to any app (by default only some system apps have this and not other apps). Such privileges would allow an app to access or modify files that it could not otherwise do, e.g. modify or remove system apps or data, or override file access restrictions and access or modify the internal data of any other app. I'm sure you can think of ways this can be abused as a security risk, and some malware will use these privileges if they are available. Even without malware, if you gave someone access to a rooted device they could use these privileges to steal or modify your data (e.g. they could just use a file explorer to copy your banking app's data - I would of course hope that a banking app would keep such data encrypted, but this is doubtless the reason why almost all banking apps refuse to work if they detect that a device is rooted). Without root such data would be inaccessible except through the app that owns them.
In fact if you are using an old version of Android (5 or earlier) there is malware that can give itself root privileges without you rooting the device. Fortunately more recent Android versions have most of these holes plugged, but basically if there is an app that can root your phone without needing a PC then your phone is also vulnerable to this nastier type of malware, because the malware can use the same trick as the rooting app.