> The sandbox will need internet access (to update data) and you will need to send code to test into it; so compromise already equals leaking all your code, without even breaking the sandboxing

Compromising all code in one directory is bad. Compromising all my data in all other directories, including mounted cloud drives, is worse.

I restrict most dev tools to access only the current directory.