If you do get any malware on your desktop, your private keys could get compromised, desktop wallets or not.
This statement itself is wrong.
If you have malware on your desktop PC, only those private keys which are stored on this pc will get compromised (considering they aren't secured in any other way, e.g. encryption).
a malware can be a lot of different things and do so many different things.
it usually is a form of key logger where you create a key randomly and securely but it steals it and broadcasts it to the hacker.
but it can also be changing the key you are making. for example you may install a wallet and after you generate the new wallet safely it simply replaces the wallet file with the one it creates. the malware doesn't even have to be online to do that. it can have the master pubkey hardcoded in it. so your wallet keeps giving you the addresses that the hacker controls
