what about save games?
Why not just bubblewrap your entire steam install? Would work for linux native games too.
I sandbox Steam using firejail, but that's not really what I'm talking about
@cjwijtmans save games are saved either in the wineprefix or in your user's ~/Documents directory (your user's home dir is always visible to wine). I am talking about disabling access to other drivers and filesystem root
It would be possible by removing the Z: drive but remember, Wine is still not an emulator and it runs the .exe just as a normal Linux process with WinAPI substitution calls. Wine can be detected quite easily and the program can then run Linux-specific code and call the kernel just fine thus not using the Windows drives and accessing the filesystem directly. Yes, this is highly unlikely for a Windows game to include malice Linux code but it's absolutely possible because there's no fundamental difference between Linux and Windows machine code, it's just code, only its structure is different.
Do remember however that wine is still running as an unprivileged user, so a windows application has limited destructive power on the system folders. Though jailing proton to the steam folder in ~/.local/share/Steam would still be safer.
Currently the entire filesystem is available to wine. I would appreciate if there was an option to disable full filesystem access without manually opening winecfg.