They can be, but the app itself has to opt in. You can see whether an app is sandboxed in Activity Monitor (it’s a hidden-by-default column named Sandbox).