By isolating applications and introducing permissions, malware that can steal or encrypt user data isn't possible even for people installing those pirated APKs.
Check out history of Java sandbox with its numerous vulnerabilities. I have no reasons to expect anything different from built-in sandboxes. It's like relying on unix user permissions and allow to run anything under untrusted user. Works in theory, but you'll be owned pretty soon, because local root escalation vulnerabilities are not that rare.
In those days the only sandbox I would trust is JavaScript one. It's battle tested.
You cannot ask for permission to bypass sandbox restrictions on Android. You need root access, which means physical access to do things like unlock the bootloader or an exploit.
iOS sandbox seems slightly weaker here due to the use of hidden/private functions to protect certain things, sideloaded apps would likely be a bigger risk on iOS than Android at the moment, but that's not something unresolvable.
In any case, the things you're discussing aren't really so problematic - isolation systems are only getting better, OS level ones are improving every day. We could easily have sandboxes at this level just as secure as the javascript ones.
The wasted bandwidth would be made clear by the OS to the user too, so it'd be trivial to identify if it was a significant consumer.
I doubt user data being protected by these mechanisms helped people to guard their data.