The way I see garry's mod is that it's more of a high level Lua modding SDK for source engine. It comes with the sandbox "game" where you can usually build stuff or hang out, and a game called "trouble in terrorist town". https://www.troubleinterroristtown.com/

You can make your own gamemodes, or "addons" that work in any gamemode. The standard sandbox gamemode is typically extended with many addons.

Your question is a bit like asking what you can do on the internet. You can build a website or you can browse other websites. So in a way the garry's mod client is just a browser. On the hosting side you can very easily start a server and almost everything regarding custom content transfer is handled automatically.

Just like the web we've had many server exploits because they can execute lua on the client. We are now moving towards a permission based system on client to allow the server to execute things like programmatically opening external links, enabling the microphone, etc.

I wanted originally not to mention "the metaverse" here, but as far as I understand the idea of metaverse without VR, these games have been doing that long before metaverse was a thing.

Second life is closer to the "metaverse" than whatever facebook is doing but since it doesn't check the VR box it doesn't count.

It's commonly used as a platform for various wario-ware style minigames, often with hubs where players can save up points to buy cosmetics in the aforementioned minigames.