I am interested to know whether is it a reasonable decision to try and restrict my own user account as much as possible to the point where I would need to use my own password much more frequently (now I use it only for mounting new disks and for system updates). For example I downloaded and opened a malicious program without administrative rights (sudo or etc.) on newly installed Ubuntu with default settings. Would this program be allowed for example: take a whole screenshot of my desktop, sniff my keystrokes (for later use for sudo as an example), listen or watch my microphone or webcam and adding itself in autostart (systemd service or gnome autostart folder, etc.) without me noticing? Of course neglecting the possibility of doing this through 0-day exploits. How dangerous could it get and is there any tips how I could secure my data in case of virus penetrating my system (except for backups and not launching malware in the first place)?
TLDR: How many rights does the arbitrary usermode(ring3) program have in context of the current non-administrative user?