Homebrew is heavily sandboxed and has been using the macOS sandbox for the best part of a decade, long before many other package managers did.

We also offer a .pkg installer and other installation options so curl | bash not needed for install that either.