I'm not really an OSX developer, but shouldn't it be possible to bypass the sandbox in a way by offering the user to install an unsandboxed auxiliary application via a download from your website which then communicates with the main sandboxed App Store application using some protocol and performs any actions which the MAS version would be otherwise unable to?

For example, perhaps the auxiliary application runs a local HTTP server with a REST API. The MAS application simply makes HTTP requests to the auxiliary application such as `POST /applescript/doStuff`.