Would you externally sandbox the file manager? You may as well just sandbox the entire [virtual] machine at that point. Which is not an unreasonable thing to do

Would you externally sandbox the file manager? You may as well just sandbox the entire [virtual] machine at that point. Which is not an unreasonable thing to do, but neither a mutually exclusive approach nor a necessarily better one.