The android one isn’t all that great. iOS sandboxing, to a great extent is a 2 step system - the app store and entitlements limit the attack surface long before the sandbox gets tested. That is not necessarily a bad thing. The sandbox on iOS would be forced to be a lot more secure if people were allowed to use the whole ABI of the kernel.