It's not front end sandboxing. It's edge function sandboxing. And they do indeed have this in prod: https://shopify.dev/docs/apps/build/functions/programming-la...

> Shopify CLI compiles your JavaScript code using Javy, our JavaScript-to-WebAssembly toolchain.

I've actually used Javy. Kind of interesting: https://github.com/bytecodealliance/javy.