So same issues as some early Bluetooth users who didn't screen settings.

Oh the humanity.

Googling air drop...

So is this a thing where you can target a specific person's phone or are you just broadcasting a file to everything within range, and whoever is dumb enough to open it?

The default setting means you can receive files from anyone in range. So you look at your phone, check for nearby users with receive left "on", and send them a file/message. The nearby user's app will show them the image/message as a notification with a dialog accept/reject option. The issue, beyond the incorrect default setting (it should be whitelisted to address book contacts) and/or user stupidity, is that the app shows the image and asks "do you want to save this" before the user has a chance to reject it.

Is it limited to images and text, or could a person send malware or other kinds of files?

You could send any files, including malware, but the receiving person have have to go through quite a few hoops to actually get it to run on their phone: accept the file, download it, get root access to be able to install sideloaded apps, authorize said install, and then actually install it.

My impression is that it’s a selected target thing.