> This is at least plausible to me: to have effective sandboxing, you need to restrict the APIs that a device can call, which means blocking the ability to generate and run arbitrary machine code on-device.

This isn't true. You can sandbox arbitrary machine code by restricting the process it runs in (this is how seccomp works on Linux).