Sandboxing in JVM is broken. Server code does not rely on that (most of the time). Sandboxing is inherently insecure. It usually comes with appropriate warnings

Sandboxing in JVM is broken. Server code does not rely on that (most of the time). Sandboxing is inherently insecure. It usually comes with appropriate warnings (ex: Python) and everybody is expected to understand that it is a half measure at best.