It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.