In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe.
TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; tools to monitor processes, system resources, open ports, network traffic, etc for suspicious activity; a policy to only run signed executables, configuration of the SELinux secure kernel mod, keeping the OS and application up to date with security patches, and other things.
Your question is very broad to answer directly. Instead I'll break it into several cases based on the configuration of the system, and what the attacker is after:
Case #1: Personal computer
Let's say the linux computer in question is my personal laptop. I effectively use this as a single-user system and I type
sudo pretty regularly - so all of the things you mentioned apply. Moreover, if the attacker is trying to steal my personal information like credit card numbers, tax documents, etc, that's all sitting in my home directory where this user has access to it. If it's ransomware and wants to encrypt my personal files - same thing. They want to install a background process to make my computer part of a botnet, that doesn't need any special permissions.
Case #2: Server, admin account
The damage of getting malware onto an admin's account is less than the end-user case above since the admin account probably has no valuable data in it. but even so, an attacker can probably do some damage by having a packet sniffer inside the network, or by opening a port that allows the attacker to do pen testing from inside the network. Here you would rely on your firewall configuration to protect you against some of this and hopefully notify you to the suspicious activity so you can clean it up.
If the admin types
sudo on a regular basis, then yeah, you're probably in trouble.
Case #3: Server, non-admin account
Imagine the use in question is
tomcat - a very low-privilege user that runs the web server applications. This is the case people usually think of when talking about "principle of least privilege", and getting malware onto this account will be the least dangerous of the three case I've mentioned.
Also consider that Privilege Escalation exploits exist for linux that would allow a low-privilege user to bypass the OS security and turn themself into root. Generally speaking, keeping up to date with security patches protects you against this, but actors wealthy enough to purchase exploits on the black market will know about zero-day exploits that are not publicly known, and have not been patched.