I think this is especially problematic for Windows, where a simple and effective lightweight sandboxing solution is absent AFAIK. Docker-based sandboxing is possible but very cumbersome and alien even to Windows-based developers.
I don't like that we need to handle docker(container) ourselves for sandboxing such a light task load. The app should provide itself.
Windows Sandbox is built in, lightweight, but not easy to use programmatically (like an SSH into a VM)