Comment by neolog

Sandboxing needs to happen by default for all applications, without additional work by users. It needs to be an OS- or package manager-level feature. See iOS for example.