Would you consider yourself a typical example of a naive user? The security default needs to work for everyone. I think the sandbox approach is better than expecting everyone to correctly decide when it is or isn't okay to allow a site to run code.

Yes in the context of iOS, Android and UWP native apps.

You must run in much better circles than I do. Nevermind a naive user, the average users I know wouldn't know how to disable javascript, or whitelist sites, or that there even were sandbox settings in the OS.

Some of the older people I know can't even correctly choose between between writing a text message, and a facebook post.

If you think you are a typical example of a naive user, I would hate to see what you expect of the average user.

You completely misunderstood me.

iOS, Android and UWP sandboxes for native apps are always enabled, there isn't any configuration for naive user available.

You just allow or not the access to specific actions and that's it.

On UWP you cannot even access files directly, the user has to select them for your application.

You can only change the way sandboxes behave via developer settings, but that is only in the context of debugging, which naive users will never do anyway.