It does not need access to your full machine. It can literally run in a vps.
The thing is that if you want it to do useful things, you kinda have to give it access to some of your accounts.
How do you think the vibe-coding layman audience is using OpenClaw?
Most of the people using it probably don't even know what SSH is, let alone using a VPS to maintain a personal bot for them for years with no maintenance. They know Vercel and Supabase. They will run it on their local machine and just keep clicking yes to everything until they get the result they want.