> The sandbox will need internet access (to update data) and you will need to send code to test into it; so compromise already equals leaking all your code, without even breaking the sandboxing

Compromising all code in one directory is bad. Compromising all my data in all other directories, including mounted cloud drives, is worse.

I restrict most dev tools to access only the current directory.

You only need internet access to grab the image, I don't think trivy requires internet access itself. All of my image scanning tools run in isolation.