Those are two different kinds of sandboxing. One protects application from itself - "here is what I use, if I try anything else, then it's a bug".

Sandboxing you're talking about protects system from the application. You really need both.

re: restrictiveness

With external sandboxing, you need to restrict to a common denominator of all application states you see youself observing that application. Internal sandbox can adjust itself as it goes.