This is concerning, especially as the steam client is a platform for downloading remote code execution-enabled programs. I can't imagine the number of security

This is concerning, especially as the steam client is a platform for downloading remote code execution-enabled programs. I can't imagine the number of security vulnerabilities in Steam games. Most games require invasive anti-cheat services that are connected to a command-and-control sever with full RCE capabilities (and RAM dumping/analysis, etc). If you want a specific example, take Unreal Tournament (1999) on steam: this is an old game, yet its security practices remain unchanged. Most public servers I tried to connect to pushed dlls on my computer, that were then loaded by the game executable, to provide a variety of mods, anti-heat services, and more. That means anyone hosting a UT99 has RCE and privilege escalation capabilities on any client that connect trough Steam, without even trying hard. More concerning is the fact that games are a very specific medium: robustness/security is often not the primary concern, most are networked, and few are patched [a few ears] after release, yet remain launched on a regular basis for decades to come. Moreover, newer games tend to push resource usage too much for elaborate sandboxes. That's the reason why I run Steam trough flatpak's sandbox: at least, it, or games, don't have access to my filesystem. I still have concerns over the login token, though. Wayland does provide some extra protection against potential keyloggers/others, but I wish Steam itself was constructed like a browser, sandbox-wise. (yes, the remote dll loading happened on Linux, trough wine/proton, a testament to the engineering of these compatibility layers).