My understanding is that a lot of the games on Steam are actually executed in some kind of sandbox, but I am sure if that is just for compatibility/emulation reasons, and which directories are still accessible in that case.

I wish there was better documentation for this, because "random indie game demo cannot upload my family photos" would be a great selling point for SteamOS/Bazzite.

As it stands, the Steam flatpak is probably the safest way to play games (which does not work on Bazzite).