Widgets are interactive elements that access system APIs to do things like show memory usage, list open programs, send kill signals, script the window manager to hide or move windows, and a lot more.

You could theoretically sandbox widgets, but I’m not sure how easy that is. I suppose you could wrap KDE itself into a Flatpak sandbox so it can only see the system files it absolutely needs, but all “sandbox every part of the UI” attempts I know of have died because compatibilities made the unusable.