I think the issue is really just that effective sandboxing is really really hard to pull off right without also severely limiting the capabilities of the langua

I think the issue is really just that effective sandboxing is really really hard to pull off right without also severely limiting the capabilities of the language/environment in undesirable ways, even for simple applications. Given that most of these things are volunteer projects and making strong claims about security is dangerous when you can't back it up, it's a tricky space most projects just don't want to touch.