Sure, without exploits they can steal your api keys, read your personal data, and access your browser data. With exploits they can update packages on your computer too.
No exploits needed. A simple shell alias will suffice. See my example in sibling comment.
No exploits needed. A simple shell alias will suffice. See my example in sibling comment.