There is a working branch which fully supports Sandboxing with a secure approach: https://github.com/zorgiepoo/Sparkle
This is set to be Sparkle 2.0.
You raise an interesting point about security. It's about what you trust. Do you trust the app, or do you trust the developer of the app and their update infrastructure too. To have auto updates you need to do the latter.
Allowing automatic software updates requires leaving a big fat hole in your Sandbox...
(And what's the point of restricting your app to a sandbox, when it can replace itself with a non-sandboxed app?)