Sandboxing didn't prevent fake versions of Fortnite and other serious malware from spreading on Android, nor does it generally prevent information theft and privacy violation through malicious use of legitimate APIs.