Why does a plugin system immediately imply sandboxing?