I mean I trust Firefox to not steal my data, or maybe $APP_NAME, but do I trust the C++ code? Or maybe it's an app that's been pwned a lot. Sandboxing has uses

I mean I trust Firefox to not steal my data, or maybe $APP_NAME, but do I trust the C++ code? Or maybe it's an app that's been pwned a lot. Sandboxing has uses other than running actively hostile apps (for which I'd argue this kind of sandboxing isn't enough).