Sumatra has more security features than most other readers? For example, it doesn't support JavaScript. And it doesn't support GoToE. The text features, both

Sumatra has more security features than most other readers? For example, it doesn't support JavaScript. And it doesn't support GoToE. The text features, both strings and fonts, get sent through HarfBuzz for sanitisation. How is it not sandboxed?