A malicious application would focus on deleting everything, so what more is destroyed if UPnP is enabled?
Where'd you get that idea? A malicious application would have no interest in deleting stuff, your PC is way more useful intact, but under remote control.