Was kinda difficult to understand your question, but Citrix is not a security risk for virus. It's just an additional layer on top of terminal services.
Offcourse if you set all your users to be local admins on the TS and publish IE to them it can be a risk.
SG