One thing I quite liked about the sandbox is running marginally (un)trusted code either interactively or as part of some process, and for that sandbox-exec(1) is great. Security best comes in layers and it's a worthy addition to the toolbox.

It's used by homebrew[0] during the build steps, I hear it's in progress for Nix, and I may make use of it in the future for archmac. Unfortunately it's been marked as deprecated in the man page:

    SANDBOX-EXEC(1)           BSD General Commands Manual          SANDBOX-EXEC(1)
    
    NAME
         sandbox-exec -- execute within a sandbox (DEPRECATED)

[0]: https://github.com/Homebrew/brew/blob/master/Library/Homebre...