No, I'm merely suggesting that they are not a solution to the problem, and that the fundamental issue has to be approached at the language level. What you are

No, I'm merely suggesting that they are not a solution to the problem, and that the fundamental issue has to be approached at the language level. What you are building is mainly a smoke detector (and maybe a bit of a sprinkler if it takes some decisions itself), not fireproof doors (that only at install, not test- or runtime). Smoke detectors by themselves cannot prevent fires from spreading and are not completely reliable. Analysis tools are still useful - even with perfect language-level access and resource control, packages which are given many required permissions may behave maliciously (e.g. through compromise of any component in the development or distribution pipeline), or return malicious data (which is out of scope/unsolvable at the language level). Both approaches complement each other nicely.