> you need it to work together with some network based package manager

Well, you can disable sandboxing if you want, although it's not recommended. This lets you run a package manager that requires networking in a derivation.