How much data can an app steal from my MacBook if I allow its system-wide execution? I'm interested in knowing how to monitor and possibly sandbox an app and its relative background processes in MacOS. Is there some internal utility hidden somewhere in the system tools (even CLI), or maybe some tool from the web? I cannot find anything about this. Furthermore, it looks like everyone still thinks Mac OS cannot get malware and it is not helping.

Let's say I want to install an Android Emulator to play android games on my MacBook. I know that the majority of the emulators are Chinese, therefore I will expect a significant amount of telemetry. 
I decide to go with the app Mumu. During the installation, the app asks me to input my password to allow the creation of a new Helper (anyway, what is it and what does that even entail?). In order to do this and continue with the installation, I have to allow the (initially blocked) execution of a "system software", in Security &amp; Privacy >> General (pic).

If I ever decided to play along, how could I monitor the effects of this choice? Can any app with these privileges access any other app data? In particular, I am interested in keeping these safe:


browser history (eg. chrome, firefox...)
KeyChain
files all around my disk (duh... )


What is safe and what is not?
How can I know (in real-time possibly) what a specific service/process/app with granted privileges is doing to my computer?

Thanks in advance
This is not an exact answer to what you are looking for, but it is ONE way that you can keep your system safe.

Basically it is an outbound firewall that I have been using for years (I hold no interest in the company, just a happy customer) and it is called Little Snitch.

Basically, once installed, it monitors ALL network traffic and throws up a warning when it sees any. Training it to respect your preferences can be a bit tedious as it presents a dialog on absolutely everything on the Mac that wants to talk to something on the internet.

But with a little perseverance and some intimate knowledge of what certain processes are you can essentially block anything that wants to initiate anything in the way of an outbound network connection. It's not free but worth every penny.

There are likely other things out there that might do the trick. I think there is a Docker project for the Mac, but I have no expertise or knowledge of it other than it (may) exist. But Little Snitch is a worthy addition to every Mac user's Mac who enjoys fiddling around with more than email, a web browser and a few apps &amp; games.