Are there significant differences re: sandboxing between Lua and monty? Just curious if there are any holes that a Lua sandbox has that monty might account for

The main property that's really important is that Monty VM state is fully serializable and resumable. So you can run the VM code until you get to a host call, then serialize and persist the state to disk. Then, at a later time you can resume the VM with the tool call results.

Even Luau (which was made for sandboxing user code) don't really have this property.