I built a separate Arch Linux box just for Steam gaming. I will never log into any of my sensitive accounts -- email, banking, etc. -- on that machine. It's a Framework laptop so I can physically keep the camera and microphone disconnected. I basically treat it like a public terminal.
Do you truly expect any steam games to have anything like a root kit that’d exfiltrate your credentials? I feel if this were the case literally anything I install on my PC would be suspect. Installing ssh would be a much more scary thing than a random steam game.
The concern is that malicious actors can take advantage of what is certainly a poorly written rootkit.