How is this possible, if the OS is secure and apps are properly sandboxed? I can visit any website in Safari and expect to be safe, why can't the same be true

How is this possible, if the OS is secure and apps are properly sandboxed? I can visit any website in Safari and expect to be safe, why can't the same be true of apps?