Yes, by containing the payload and decompressing it. The difference is that by not sandboxing it, that malicious file could also cause its payload to be execut

Yes, by containing the payload and decompressing it. The difference is that by not sandboxing it, that malicious file could also cause its payload to be executed in the permission scope of the decompressor.