This is factually false. You download subtitles from a website (generally, opensubtitles.org); if somebody has maliciously uploaded a malware to that website, you will end up downloading that.

Whether the carrier is effective or not (it's dubious that downloading malware masked as subtitles will be executed) is besides the point.