Sandboxing a JIT compiler is impossible to do perfectly, so there will always be the possibility of a sandbox escape, allowing the device to be jailbroken; but alsio for bad actors to take control of the device.