From spammers, mostly. It is a lot of extra work for the spam 'bots to
download enough of the message to grab the "Reply-To:" address, and not a
lot of extra good addresses (most people don't have anything there), to make
it worth the effort.

From viruses, no. Swen was the first virus to routinely harvest "Reply-To:"
email addresses, and they grabbed mine. Even so, Swen has be thwarted by
using an email address with either "spam", or "delete" in the user part of
the address. Check my "Reply-To:" address for an example.

In either case, I wouldn't recommend using an email address that I didn't
want hammered by spam or viruses. My current "Reply-To: <email address>"
works; but it is an alias that I created, and I can destroy it if necessary.

Originally, this field was used when a sender needed to use one email
address for sending, but need to pick up replies to a different email
address. "Munging" to avoid spam came later.

It's your choice.  Might read Norman's post for some added comments about
the Reply-To box.