I think it may be a bit of a problem being a project from Google. Making the system totally secure is a difficult task. That is true for all sandboxes. People find vulnerabilities, people fix the holes.

The problem is not that NaCl is insufficiently secure, but any vulnerability will be spun as "Google making your system insecure". I think an independent group doing the same thing would be no more or less secure, but wouldn't have the baggage that would come from being seen as a component of a much bigger entity.