And executable you run has access to any file in your home directory, including SSH private keys, secrets in config files, browser cookies, passkeys—all of it. That includes the thousands of npm modules installed as a transient dependency of at least one tool you use that brings node as a dependency.

Windows at least has a proper ACL system; on Linux it just takes a single compromised executable to loose everything.