Right, but if a malicious JPEG exploits a code execution vulnerability in libjpeg, a malicious Web page exploits a WebKit vulnerability, or a malicious certific

Right, but if a malicious JPEG exploits a code execution vulnerability in libjpeg, a malicious Web page exploits a WebKit vulnerability, or a malicious certificate exploits a bug in OpenSSL, proper sandboxing can do a great deal to mitigate the damage. Thus if "most" applications on OS X are sandboxed, the platform and its applications become less attractive targets for those exploiting what are often cross-application, cross-platform vulnerabilities. Sandboxing is not restricted to the App Store, by the way.