Well that defeats the purpose of a sandbox. A sandbox is specifically to disallow apps from touching OS or private data. But there's no reason such apps can't

Well that defeats the purpose of a sandbox. A sandbox is specifically to disallow apps from touching OS or private data. But there's no reason such apps can't live side-by-side. I use Emacs to edit my hosts file, it's pretty convenient. A sandboxed Emacs would not be. But I don't mind if the painting app I download is sandboxed because I'm going to be dragging-and-dropping my artwork into that program and I don't want it having access to my disk or network outside its sandbox.