I would be shocked if Safari did not also sandbox EME just as tightly as Chrome and Firefox. Of course, Safari isn't open source, but a sufficiently knowledgeable person could locate the background process Safari uses for EME (it probably has a very distinctive name) and check what the sandbox it uses is.