Your scenario already has the malware running with the user's privileges. This means that the malware already has more privileges than sandboxed GMPs in your scenario.

While that is a valid point, it doesn't changes the fact that the more attack surface the more likely to break through.

Sometimes you have few limited vulnerabilities that can add up to complete systems compromise.