But are the compiler+OS that runs the ffmpeg executable really a sandbox ?
For executables on Linux there are things like bubblewrap or firejail. One can also use a restrictive container. But those are strictly weaker than browser sandboxes.
The most secure way presently is to use qubes-os that allows to use a very hardened VM to run individual applications.
Which is of course better than zero sandbox escapes.