It can still corrupt files. I knew that wine was the shut when I had to delete my wineprefix because Eve Online complained about corrupted file. Even better, a virus scanner would run and detect the malware.

unless its just simple ransomware that will nuke your /home (or Z:\home) content if you don't sandbox it

technically that is only true if the malware in question does something in the kernel or relies on an unimplemented wine api call, since a lot of malware is an infostealer or ransomware, its quite likely that it'll work just fine under wine