I built a separate Arch Linux box just for Steam gaming. I will never log into any of my sensitive accounts -- email, banking, etc. -- on that machine. It's a Framework laptop so I can physically keep the camera and microphone disconnected. I basically treat it like a public terminal.
I feel if this were the case literally anything I install on my PC would be suspect. Installing ssh would be a much more scary thing than a random steam game.