Well, Android 4.3 is very old OS. Sandboxing is one thing, permissions are another. You can't deny Internet usage for application with unix permissions, for example.
Re:Fuchsia Developers Website
by JetSpiegel on Sunday June 30, 2019 @04:59AM
(#20317166)
You can with iptables.
Android's Application Sandboxing primarily relies on Linux's user security model. Each app is assigned a UID and run in that "user's" context. To quote the official docs:
> The sandbox is simple, auditable, and based on decades-old UNIX-style user separation of processes and file permissions.
https://source.android.com/security/app-sandbox
SELinux is an extra layer of security that really benefited system services, drivers, and other exploit vectors. All apps remain sandboxed via normal user security on Linux, and then SELinux sprinkled on top for further hardening:
> Prior to Android 4.3, these sandboxes were defined by the creation of a unique Linux UID for each application at time of installation. Android 4.3 and later uses SELinux to further define the boundaries of the Android application sandbox.
https://source.android.com/security/selinux