So viruses are data but living things are code. Viruses are just malicious data that exploits unintended behavior of the code to replicate itself. Of course all code is just data.

It's similar to how it's difficult to argue whether a data format is a programming language (Turing completeness is an obvious but unnecessary and insufficient distinction). "Declarative programming languages" muddy the waters but most people would agree that a JPEG image is just data whereas a PHP script is a program.