Of course they can. This is what OS engineers have spent decades thinking about and optimizing. And then stuff like Electron appears and circumvents all those optimizations. Which is the main reason I dislike it.
Sure, but with sandboxing and technologies such as Firefox Containers, containers in general (such as Docker), and VMs (together with a secure enclave such as utilized in Qubes) it can all be thrown in the trash bin. Its just a matter of time until that's the norm. iOS is already on top of doing sandboxing well.