Dropbox for Linux runs just fine as a user-mode program.

Besides, Dropbox does much nastier stuff than look at your files; it bloody hooks into your shell (Finder/Explorer) and manipulates the icons. It could decide to replace an .exe icon with the icon for a Word Document, for example.

Thought they just used icon overlays, much like all other status-icon shell extensions such as version control (TortoiseSVN). Not exactly some low level windows hack, it's a plugin system in Explorer. I probably have five or six such icon overlay extensions on my machine.