It's easy for malicious code to detect sandboxing.

Also, check out the VW Diesel scandal.