Minecraft clients can access almost all files on your computer, including discord login tokens, Minecraft accounts, and even chrome passwords. They also have the ability to replace Minecraft's executable with whatever program they desire, including remote access tools and trojans. Several popular clients such as Aristois, Inertia and Sigma are obfuscated to make their code unreadable which means there is no way of telling whether they contain said malicious code.