To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.