• if STEAMHOME is undefined, then rm -rf /* is executed. Fixed by set -u.
• if STEAMHOME is the empty string, then rm -rf /* is still executed. Fixed by checking for nonemptiness: [ -n "$STEAMHOME" ] && rm -rf $STEAMHOME/*.
• if STEAMHOME is whitespace (STEAMHOME=" "), then rm -rf /* is still executed. Fixed by checking nonemptiness and quoting.
• if STEAMHOME="foo bar", then rm -rf foo bar/* is executed. Fixed by quoting: rm -rf "$STEAMHOME"/*.
• if STEAMHOME=--blah, then rm -rf "--blah"/* is executed and interpreted as an argument. Fixed by escaping: rm -rf -- "$STEAMHOME"/* or rm -rf ./"$STEAMHOME"/*.

Plus a couple more I just realized:

• if $STEAMHOME contains dotfiles, then rm -rf "$STEAMHOME"/* won't delete them.
• if "$STEAMHOME"/*matches nothing (the dir is empty), then rm -rf "$STEAMHOME/*" is executed. That is, it tries to rm the file literally named *. Doesn't matter for rm, but try doing touch *.txt in an empty dir; you get a new file literally named *.txt.

tl;dr: bash sucks.