Yes, but there's a difference between an exploit being the sandbox not working as intended and the sandbox being used for a purpose for which is not intended.

Yes, but there's a difference between an exploit being the sandbox not working as intended and the sandbox being used for a purpose for which is not intended. Everything is exploitable to some extent.