The latter does need to be a subset of the former, or else an attacker can trivially work around limitations on "what it should be able to do" by spawning a child instead of doing the thing directly.

But yes, it's unfortunate that macOS sandboxes cannot be nested.

If the child could do different things to the parent malicious processes would spawn child processes to do stuff they shouldn’t be able to do, though

That “just” is doing a LOT of work.

This is really hard to do in general