MSIX only enforces a sandbox if an application doesn’t elect to use the restricted capabilities that allow it to run without. File system and registry virtualization can be disabled quite easily with a few lines in the package manifest, as well as a host of other isolation features.

This is a good thing, and it makes MSIX a usable packaging format for pretty much any application under the sun - but nobody should assume a MSIX package is safe just because it’s a MSIX package.