Why would macros need sandboxing if the crate build doesn't have any? What is your threat model?

Without proc macros, running `cargo build` or `cargo check` can already do anything via `build.rs` scripts. Without that, you still run arbitrary code from crates.io if you do `cargo run` or `cargo test`.