I was trying to download something off a sketchy website, and ISO was a reasonable extension for what I was trying to get, but I was still pretty sure it was malicious. I didn't put much thought into it, and went "well, ISO isn't directly executable, right? It's just an archive." and downloaded it, scanned it with microsoft defender, and opened it as an archive (NOT mounting it or whatever, opening it like you would a .ZIP) and then opened a sub-archive. I didn't run anything from it, because I'm not a complete idiot, and yep, everything in it looked super generic and sketchy, not what I was trying to download. I checked an ICO file in it with paint.NET, too, just to confirm.
I read What damage can a malicious .iso file cause without explicitly executing it? but it doesn't mention if opening it as an archive without running anything inside can allow it to harm my computer. Same goes for most other stuff I've googled.
(Running Windows 10, downloaded via Firefox, if that helps.)