Is it possible to infect given machine using that information, without needing the user to install something themselves ... Additionally, can the malware run/spread/start by itself or is it unfunctional if it's not manually run?
Systems have bugs and bugs can be exploited. One example is the Broadpwn issue which made it possible for an attacker to execute code via Wifi on the victims device with highest privileges - and no participation from the victim was needed for this. Another such bug was Eternalblue which allowed an attacker on the same network to execute code with high privileges - again no participation from the victim involved. This bug was famously used in the widespread WannaCry ransomware attack or in Petya and NotPetya attacks. And there are many more such problems, like recently Log4Shell.
How easy is it for someone to infect my devices, how vulnerable are they?
It depends a lot of what these devices are, how current the software is, how complex these devices are, what kind of services these expose etc. In general: less is more, i.e. more specialized devices usually have less complexity which means less bugs. They also usually come with a smaller attack surface than more general purpose systems. Additionally there are security by design principles like privilege separation or a robust defense in depth architecture - and these are again easier to implement solidly for simple systems than for complex systems.
I would like to know how i can best protect my privacy.
Privacy is not the primary concern here, but data integrity, confidentiality and availability. Privacy issues can happen even if the systems are not exploitable: all the user tracking and profile agglomeration on the internet is not due to security issues and exploits at all.