One thing the App Store does is automatically verify the sandbox rules are valid. If they aren’t the app is auto rejected.

How do you think the kernel knows what an application is allowed to do? Seriously, I want you to think of a way that the kernel of any platform could know what facilities an app should have access to.