Unpopular opinion maybe, but I think sandboxing and app packaging/distribution should be entirely separate components so the user can mix and match the two freely. Combining both into a single “solution” makes for inconsistency and trouble.