If running it via Lutris or from the command line you can use as command prefix a proper sandboxing application like Firejail so that wine itself is launched inside a sandbox.

For example I have it set up in Lutris so that by default all my games run with networking disabled.

As per your point, Wine is just an adaptor layer not an emulator or sandbox, so a Windows binary running in Wine can try and load Linux libraries and start doing Linux stuff rather than Windows stuff if it succeeds (in other words, it's perfectly possible to make Windows malware that acts as Linux malware when it detects its running with Wine)

Good to know!