I mean, both contribute to the security of the ecosystem. There are plenty of APIs available within the sandbox that are meant to be used by developers to use

I mean, both contribute to the security of the ecosystem. There are plenty of APIs available within the sandbox that are meant to be used by developers to use for legitimate purposes. But those same APIs could be abused by malicious actors as well. That is why Android has historically had more problems with malware even though Android apps are also sandboxed.