[Ryanmf]

I'm not sure why the Mac App Store represents the high water mark for safety (as opposed to a secure server maintained by the people who actually developed the software or MacPorts/Fink/Homebrew) but whatever.

Many popular audio plugins are themselves plugin hosts (just off the top of my head, Native Instruments' Reaktor, Maschine, and Guitar Rig and Five12 Numerology match that description). In this context, wouldn't that require nested sandboxes? You're sure you don't see any potential conflicts there?

[LaGrange]

Not really. They still can't access files outside of what has already been granted to the main application.