Namespaces and cgroups provide resource accounting and some limited isolation between trusted workloads. They're not considered a sandbox or security boundary because the processes have full access to the Linux kernel APIs, which are not well-hardened.

To provide a security boundary between Linux processes, it's currently considered best practice to use something like Firecracker or gVisor.

I agree containers are more for ease of deployment, not security. But security is about shades of gray… limited isolation is one of those.