Why aren't they running agents on isolated computers without Internet access? This way, breaking free of containers would not matter.

It is truly a security nightmare that so many people are have given agents root access to their entire computers, in addition to presumably very private personal information.