True, but most people don’t sandbox their games, and while a userspace binary can’t usually get root privileges, it doesn’t need it to exfiltrate their summer holiday pics or health bulletin.
A good first step to mitigate this is to use separate gaming and serious accounts.