I mean, lots and lots of software goes through decades of development and yet still contains major security exploits. A year and a half isn't necessarily a huge amount of time to develop a full sandbox for code you don't even control.