That's not completely true. Sandstorm was built for federation, but also security (e.g. against malicious apps), and it took a while to get the right model in place to provide both. It's now possible for apps to request access to each other and to outside servers, but Mediagoblin hasn't been updated to use that feature.