I don't think it's fair to say capability-based security doesn't solve the whole problem. Although it's true they're not nearly as mainstream, projects like Capsicum[0] are still being worked on and discussed, there are modern capability-restricted sandboxes like Caja[1] and the Pony language claims to be capability-secure[2]. Not to mention it's the backbone of Sandstorm's Cap'nProto[3].

[0]: https://www.cl.cam.ac.uk/research/security/capsicum/

[1]: https://developers.google.com/caja/

[2]: http://www.ponylang.org/

[3]: https://capnproto.org/