Userland can run DoS attacks, it can mine crypto, it can run keyloggers, it can steal, encrypt, and delete your files, it can make your system not properly startup, it can replace sudo or other programs that ask for passwords with a custom version, it can steal whatever's on your clipboard, it can infect other operating systems (depends how they are mounted), and much more.