You see sand boxing and app stores as two different things, but they’re not—the iOS security model relies on this sequence of steps:
1. The application developer creates a manifest that lists the privileges the app wants, and includes it as part of the code-signing request;
2. Apple’s App Store review team audits the application more thoroughly according to the privileges it has claimed;
3. Apple only code-signs the app bundle if the app stays on the strait-and-narrow;
4. The OS (through Gatekeeper) enforces the content of a code-signed app bundle, and therefore makes any included capability manifest immutable (in the sense that, if you change it, Gatekeeper considers the app considered and won’t start it);
5. The OS (through the capabilities system) enforces the restrictions from any included capabilities manifest on any high-level framework calls.
Note that there’s no actual linkage going on between code-signing and the capabilities manifest, in a way you’d expect from e.g. a Docker image. There’s no real “application sandbox” here. There’s just an Apple signature on the app bundle, telling you Apple saw this app as-is and approved it; and then, separately, an entirely optional opt-in capabilities system for which an app can claim any capabilities it wants.
If you take Apple out of the picture as a central signer, then 1. apps could claim any capabilities they liked, and nobody could tell them different (this is more like Android, where installing something presents you with a list of the capabilities it claims); but more importantly, 2. apps wouldn’t even need to use the capability system at all. Like I said, it’s opt-in; regular binaries run on macOS (and iOS!) just fine without living in an app-bundle with a paired capabilities manifest.
So, the whole security model of iOS (and macOS under Gatekeeper strict mode) comes down to “Apple verifies that apps are doing the right thing at some point.” Without that, there’s pretty much no sandboxing on either OS beyond what little you get from BSD user privileges and Mach port ACLs.