and by using it without restrictions they could do quite a mess on system folders.
No more really than with file manager as it is governed by windows restrictions.
Also, viruses as well could use (and often actually used) batch files if there were no restrictions.
Its the same rules as anything else (exe, com, scr, websites etc) if you didn't write it or don't trust it then don't run it. Plus viruses dont have to create and run batch files to do what they do. If they didnt exist, the services/interrupts are still there anyway so they would just use code instead (like they usually do).
As for the bat file itself, can a dodgy batch file alone even be technically classed as a 'virus'? I would class it more as a harmful script or 'trojan' at most. I suppose you could have a self-replicating script, so i guess it can :/ (but thats the least of your worries, other types of files are statistically & potentially much more harmful. At least you can open and check a bat file before running it)