There's no reason why Apple can't come out with higher priced "professional" versions which have an open sandbox, or which are totally unlocked. Alternatively, they can create an alternative site where devs can post unsigned apps, to be downloaded by others who have some sort of SDK-installed sandbox.

So long as they can keep such things separate from their walled garden of an App Store, they can maintain the seamless user experience for the end-user consumers.

A virtualized "sandbox" could have a bandwidth-rate cap built into it, so the concern about "protecting the mobile network" could also be satisfied.