[majewsky]

It is not a binary choice; there are sandboxes and then there are sandboxes. For example, a VM is a stricter sandbox than a container is a stricter sandbox than a chroot is better than nothing.

[gcp]

For sure. But he doesn't go into any details where he think the advantage would lie, which I think conflicts with calling it a "major weakness".