It’s not just sandboxing. The number of users who can be tricked into approving access to services (essentially phishing) is quite large.

The App Store review process actually does do a surprisingly good job at keeping malware apps off it.