Speaking broadly: Plenty of other issues or security vulnerabilities can exist that a good sandbox won't catch. Like software can insecurely store and transmit passwords, have bad randomness for something security sensitive, secretly be mining crypto behind the scenes and burn through battery/electricity, etc.