There may also be links to your home directory as "Desktop", "My Documents", etc. See winecfg for these. And note that your registry files may refer to Z: (mostly for fonts, it seems), or even directly to files outside your Wine directory.

If the software is Wine-aware, it doesn't matter. The \\unix\ filesystem namespace allows programs running under Wine to access the host filesystem whether it's mapped as a drive or not. And, of course, since Wine Is Not an Emulator, it could also use POSIX APIs or Linux kernel syscalls directly if it wanted to.

Have there been reports of Wine-aware malware already? (If not, the next generation probably will, though.)

Wine is not an isolation layer. You can disable the Z: drive but the applications running in Wine still have about the same access a normal application has.