There is a working branch which fully supports Sandboxing with a secure approach: https://github.com/zorgiepoo/Sparkle This is set to be Sparkle 2.0.

You raise an interesting point about security. It's about what you trust. Do you trust the app, or do you trust the developer of the app and their update infrastructure too. To have auto updates you need to do the latter.