Not really taking sides here, but sandboxing is not a panacea, unfortunately. There's also fingerprinting, abusing bugs in the system, faking system password fields, forcing the user to disable restrictions to the app so it works. There isn't much of a purely technological solution.