is it sandboxing shell/python scripts downloaded? Or programs installed by brew.?

While I'd love to check all the code I've downloaded for sneaky problems, I'll agree that in this day and age that isn't entirely feasible. At some point, you have to hope your backup regimen is working.