You're 100% right. Not only can they steal data, but they could use kernel level access to make your hardware misbehave, perhaps even to the point of damage. They could probably trash a hard disk or GPU for instance. It also gives them a locally controlled device on whatever network you're on. From there they can weaponise their new access to attack other devices on the network, or cause the network itself to fail.

It just goes to show how dangerous this is, that even a programmer and security enthusiast like myself forgets to mention a huge chunk of the possible damages.