Per definition, ASIC are never affected by malware that is loaded onto them - much as a pizza box can not be taken over by malware. ASIC do not execute a program you can load - they have no "code". ASIC are specialized chips, and the wiring is determined by the factory. They are VERY specialized. They also lack any higher function, so any ASIC miner will combine ASIC with controlling computers. But the ASIC itself can not be affected by loading malware on it because the ASIC can not be changed. It is simple like that. As comparison, open the engine compartment of your car and turn your car engine (not the computer, the engine block) into a TV - by loading malware on it, not by starting installing hardware.
When you make an ASIC, you technically write a program, but the compiler then does not generate machine code, it generates the layout of the chip to execute the program. And the chip factory creates this chip. The "wiring" is hardwired. It is not a general chip running a program that is loaded later (as is any regular computer).
Commodity hardware is more easy to take over because millions of computers on the internet are run by people that are not smart enough to run even the most basic security on them, and millions are taken over already. So, it is easy to install minders on them.
The main point, though, is not to take them over - it is that ASIC are BRUTALLY more efficient than computers at mining bitcoin. At the moment you could take over half all infected computers and I doubt you could do a 51% attack with them because yes, ASIC run the show and are that much more efficient.