This exactly. Bypassing sandbox should be like installing software from tarball as opposed to package managers: possible but pretty much discouraged, an “escape

This exactly. Bypassing sandbox should be like installing software from tarball as opposed to package managers: possible but pretty much discouraged, an “escape hatch” of sorts.