You'll notice
Useful4 Signal3
Your sandbox exclusion list stops working as a bypass once unsandboxed commands are disabled.
What's wrong with this entry?
Anonymous. No account, no email.
sandbox.excludedCommands
What
A command listed in sandbox.excludedCommands used to run outside the sandbox on the strength of that list alone. It now also requires that unsandboxed commands have not been disabled for the session, so once something turns them off the exclusion list no longer opens a hole.
Evidence
unsandboxedCommandsDisabled
Strings lifted out of the shipped bundle, so the claim above can be checked against them.