Sites like this played a large part in increasing my bravery and familiarity on the web, on which I now earn my living.
Save for having flash enabled . Hard to believe they've validated all 128,000 games.
Things that native apps can do trivially but that require explicit permission for accessed in Flash (or the web in general): filesystem read/write, listen in on microphones, spy with webcams, etc etc.
If you have a flash zero day (and they totally exist!), you can do those things, but that significantly raises the difficulty, which reduces the number of attacks you'll actually see in the wild. Most attackers aren't the NSA or Mossad, and resources that they have to spend on getting and exploiting zero days are resources they can't spend on other parts of the exploit chain.
Another way of putting this is that there are two senses of "sandboxed" - one is having a limited API surface and one is using software fault isolation techniques on the interpreter/runtime itself. Flash (and JS) always had the former, even though the latter is fairly recent.