missing-root That makes no practical difference since those provide the same functionality. Even if you entirely avoid all the ways of escalating privileges to root from there, your applications and data is in your main user where they largely run with full access as your user. Sandboxing is largely opt-in and has holes in the containment of apps. It's still designed around granting most access at install time based on whatever the app requests. Anything running as your main user is equivalent root if you ever escalate to root from it, but even if you don't it has access to everything that matters on a typical system without any exploitation involved.
The attack surface of sudo for privilege escalation from unprivileged users is present simply by having it installed as a setuid binary along with other setuid binaries. Any reasonably well contained applications can't make use of those due to having their ability to elevate privileges disabled. On a system that's using whole system MAC policies without huge holes in it, it would barely be relevant but it wouldn't be present on those systems in the first place in practice.
