Has a year gone by since they were introduced where some kind of sandbox jailbreak hasn't been published? And: it cost Google many hundreds of thousands of dollars to engineer the sandbox system it has, just as it cost Adobe huge amounts of money to retrofit sandboxes onto PDF.

How well sandboxed is nginx? Answer: not at all.

Also, you understand that any VM system that grants the security capability you're talking about also grants content software the ability to protect content, right? They're two sides of the exact same coin. You don't see that they are, because the "security" sign of the coin implicitly but subtly presupposes hostile code is running on the machine already, where the "DRM" side of the coin obviously hosts adversarial code, because that adversarial code is the "protagonist" of its story.