I’m aware it isn’t designed to be a sandbox, I’m just betting that the typical exploiter wouldn’t target wine past writing stuff into mounted filesystems. So at most they’d wreck the proton prefix and perhaps spawn a few processes within it.