Quinn is wrong. The recommended way for third parties to sandbox their code definitely remains the one the platform provides. That it is not considered to be stable is expected and the relationship between third party developers and Apple for this API has been consistent for at least the last decade.

Endpoint Security isn't usable for this. It's meant as a stable API for virus scanners, basically.

The sandboxing API is internal, but, Chrome uses it extensively. So Apple is limited in how much they can break it, otherwise new macOS versions can't run Chrome.

Several years of observing Apple's security team and what the largest third party sandbox clients (…browsers) are doing.