I sandbox all my utilities and programs in case some compromised third-party dependency decides to run lose. It's a way to limit the blast radius.