User mode and sand boxing mean that the entire computer doesn't get compromised. However, the computer is not the important asset... the user's data is the important asset, and the virtual app has all the access to it that is necessary to do evil.

In other words, malware attacking a virtual app cannot wipe the entire disk clean, but it can wipe the user's home directory clean or upload it to an FTP server.

The non-user space on the laptop is so unimportant that most shops don't even bother backing it up, they just reimage if something goes wrong in there. The user's space is the only part that actually matters.