> it [antivirus] only has normal user privileges (meaning it can’t go too deep into the system),
On a single user system all personal files are accessible with "normal user privileges".
> In other words, Chrome Cleanup Tool is less invasive than a regular “cloud” antivirus that scans your whole computer (including its more sensitive parts such as the kernel)
How kernel is "sensitive"? It is the same on every computer running same OS.
> Chrome Cleanup Tool is less invasive than a regular “cloud” antivirus that ... uploads some data to the antivirus company’s servers.
How do you know Chrome doesn't? Is this module open source? They write Google got it from ESET so it is possible that Google themselves never saw the source code and received it as a binary module.