Sure, malware could do this. If a system uses a computerized device to control a physical process, then the malware could attack this controller and cause it to do something or ignore something that causes destructive results.
An example might be a pressure control loop in a cooling system. There could be a computerized controller that manages the coolant fluid pump on/off based on temperature of the system. Malware could infect the microcontroller in this system, and cause it to ignore temperature inputs, or falsely state that the temperature is too cool, thereby shutting off the pump. The system then overheats causing real physical damage.
IRL, the risk of this is fairly low... Yes, there are an insane number of microcontrollers and computers managing physical things, but their connections to the outside world, programming models, and operating systems tend to be proprietary or closed enough that they are hard to determine from the outside looking in (unlike Windows and the standard PC architecture). So, they can be quite difficult to hack. But, if someone spent enough time and had enough insight into the components and architecture of a system, it many cases, it can be done.
