The fact that exploits exist doesn't imply that using sandboxes is equivalent to running untrusted code directly.