But not with a separate user? As a process running under your normal user can access all your files and even memory of all your running processes by that user.

But not with a separate user? As a process running under your normal user can access all your files and even memory of all your running processes by that user. Its not just kernel stuff that is bad.