We really need better (easier to use) sandboxing for apps, or in this case a project (create directory, few allowed apps, no access to rest of fs or a dummy fs, whitelisted urls/IPs only, etc.).

Sure you can use a VM, a container, firejail (for an app), etc. but it all has quite a high barrier to entry & burden to bother with, so the vast majority don't, and the majority of the rest only do occasionally for something they already trust less.