At a minimum they need access to a directory the user cannot subvert. If they were entirely contained to $HOME, then an attacker who found an unlocked shell can

At a minimum they need access to a directory the user cannot subvert. If they were entirely contained to $HOME, then an attacker who found an unlocked shell can subvert all the apps. If the packaging format allows running apps or daemons then that means a system compromise. It is also extremely common for $HOME to be a network drive or even a USB stick, so better to cache stuff in /var which can be assumed to be local storage.