(Preemptive N.B.—I&#x27;m far from an expert, but I&#x27;m very interested in seeing this aspect of the topic discussed further by folks who might be experts.)<p>Isn&#x27;t the general premise here that one can choose to package up any program in as many deeply nested (virtual or physical) sandboxes as one would like, but there&#x27;s an inherent benefit to the piece of software inside all those boxes exposing to one&#x27;s adversary as few avenues as possible to attempt to escape them (specifically as it pertains to people in the business of painting targets on their backs e.g. Soghoian)?<p>Put another way, of course Gmail and Chrome have dedicated security teams, but they won&#x27;t ever have <i>prevent $GIVEN_INFOSEC_RESEARCHER&#x27;s box from getting owned</i> teams.