I would have thought that device drivers can do absolutely anything, including any kind of evil ?
So if you are unfortunate enough to download an evil one, then it’s game over.
That’s why I would never log on to my own systems as administrator, and would would only download programs from reputable sources; anything new that needed to be evaluated would be downloaded into a test machine, which would usually be a virtual machine, for convenience, always thrown away afterwards, rather than a spare test system.