Flash seems like a good example of how it's incredibly difficult to secure a system like that, even with a sandbox.

How many security updates did Flash have over the course of its life? Back in the heyday I remember it having to update multiple times a week.