There are two different types of hacked Pokémon: legitimate and illegitimate.
Legitimate Pokémon are those that are completely legal, like a 4IV Relaxed Cresselia with Slash, Protect, Icy Wind and Trick Room. These Pokémon are exacly the same as those obtained in-game. These Pokémon can be traded and offered on the GTS, with no consequences.
Illegitimate Pokémon are those that are illegal. A passive illegitimate 'Mon would be a Shiny Victini. Victini is Shiny-locked and therefore cannot be Shiny, making it illegitimate. A major illegitimate Pokémon would be something like a Landorus with Sheer Cold, or an unreleased Pokémon like Volcanion. These Pokémon cannot be traded and offered on the GTS.
To answer your other question, you can recieve hacked Pokémo nfrom the GTS, but if they make it through then they are perfectly fine and pose no danger.