As soon as I read that line the article lost all credibility with me. InfoSec is plagued with thought leaders who weigh in without understanding what they're talking about.
Artifactory should be inside the sandbox, it's not a sandbox in and of itself.
This is exactly the same problem as forwarding ports and exposing all of your internal services to the internet, but from the opposite direction - a bug in any of those services will allow the attacker to gain a foothold inside your network (or in this case, allow the agent to gain a foothold outside of its "sandbox")