This is too quick a dismissal: if they sandboxed each extraction tool they'd be more likely to be able to say that a compromised tool did not compromise the entire system or data collected by other tools. This is exactly why programs like browsers, messaging clients, etc. have moved things like media decoders into separate processes, especially since those tools can be sandboxed quite aggressively whereas a monolithic program will use a fair number of different permissions.
Sure, sandboxing all the individual components and not just the whole would help. That's not what was being suggested though, and is a significantly more complex and labor intensive task than even just fixing all the the included libraries to be more recent and not have known exploits (even thought it would pay dividends later). I wasn't dismissing sandboxing as an effective tool, just noting that it's likely not all that effective to put it all in one sandbox as suggested (and since actually fixing all the problems is likely a lot of work, it doesn't negate the effectiveness of the strategy of Signal by providing an easy solution to the problem).
