wine also lets windows executables call any syscall of the host, a malware could attempt to detect wine and just call posix syscalls even if you dont mount your drive to the virtual windows enviroment, this also means that flatpak or bubblewrap doesnt do as much as you would hope for