I’m not sure I see a real threat here.

If you’re running an untrusted workload, you’re already running it.

Whether it can communicate with another untrusted workload, even though it should be separated, meh.

Unexpected? Probably. but I’m not sure it’s a security risk.

you might have an untrusted sandboxed workload that is not supposed to communicate externally handling secrets, and a different sandboxed workload able to communicate with the external world, not handling secrets.