The problem with web browsers executing arbitrary code is really only "solved" with sand-boxing when you assume that your private personal data is stored on your hard disk. Unfortunately, since most personal data is now stored and accessed through a web browser, you have essentially allowed arbitrary code to operate on your personal data.
Emacs was compromised by a similar line of thinking, that:
Because the ability to execute code is sometimes useful when editing documents, everything should be implemented in Emacs.
Carrying these assumptions forward blindly gives rise to many of the current challenges of today.