Well an existing gem might not. But a gem you use has could have a developer's computer get compromised and could publish a malicious update. If you inadvertently download it while updating your gems you could get compromised.
The problem here is that you don't even have to get directly attacked to be affected.
The problem here is that you don't even have to get directly attacked to be affected.