The latter does need to be a subset of the former, or else an attacker can trivially work around limitations on "what it should be able to do" by spawning a child instead of doing the thing directly.

But yes, it's unfortunate that macOS sandboxes cannot be nested.

That “just” is doing a LOT of work.

If the child could do different things to the parent malicious processes would spawn child processes to do stuff they shouldn’t be able to do, though

This is really hard to do in general