Can plugins modify theme files?

Apologies if this is the wrong forum for this question.

I’m helping a friend with their WordPress site and found some funny code in the function.php file in their Theme.

Basically the code uses strrev(), decode_base64() and eval() to execute some malicious code. I’m wondering if the extensibility in plugins would allow one of them to add this code to the functions.php file, or if its more likely someone added this code to the file manually.

Thank you.