To self propagate, malware must be able to execute (i.e., “run”) a process on the host computer.
iOS/iPadOS will only run executable processes that are digitally “signed”. Without delving into to the technical complexities, digital (certificate) signing will prevent computer code from running unless the digital signature can be verified as genuine.
As such, malware is very unlikely to have a verifiable signing signature - unless the originator of the malware has very cleverly managed to fool Apple into signing the code. This situation is very rare, but has been known to occur.
In the unlikely event that malware does run on the iPad, the system architecture restricts the process to only being able to access processes (and files) within its own sandbox; therefore the malware cannot infect other resources outside of the sandbox within which it is running. As a consequence, malware should not be able to infect other files on the iPad.