Some sandbox is better than no sandbox. When's the last time somebody delivered ransomware through the browser without a user explicitly opening a downloaded file?