Automated malware Analysis sandboxes vs Reverse engnieering i know reverse engnieering malware is in top of malware analysis pyramid, but why?

What is the advantage in RE
what are the limitations in Sandboxes like cukoo, any run etc...