> So it didn't have to find an exploit in its sandbox that granted it access to the internet - it just wasn't correctly sandboxed at all.

If the sandboxing includes any form of connectivity it's not correct sandboxing. It's amateur hour.