I was always under the impression that the point of sandboxing was to keep an application exploit from compromising the system. Not to keep the application safe from the system.

Data vaults are different, think of them as an ACL around (user, application) pairs.