In general steam is going to run a .exe for a game, and as such that's really going to be able to do anything a user process can do under windows (or linux if it has a dedicated linux binary). Steam doesn't run games inside a sandbox. That includes prompting the user to elevate the process to admin, and if the user clicks yes, being able to do anything an admin level process can.
There may well be some pass/fail testing before they will list a game, and for sure if there were reports showing a game was doing something malware/illegal they would certainly investigate/remove games that breach this.
But, steam is not a protection in and of itself.