The inconvenience is always with the person writing the package. When you restrict the build to a sandbox, if it fails, it's because the package actually depend

The inconvenience is always with the person writing the package. When you restrict the build to a sandbox, if it fails, it's because the package actually depends on the thing the sandbox is limiting (usually network requests during the build). To fix this problem, the package has to change. This is why e.g. NPM does not roll out sandboxing.