I would spend a few hundred extra dollars and just get a MacBook air or mini and install 1blocker on it.

Because you're still left with the same issue? MacOS's security technology is significantly behind Windows, only its relative obscurity protects it.

System Integrity Protection would protect against many of the same threats that Windows Sandbox would (since it prevents applications from doing extreme damage to the system even with root), and by default it only lets you install software from developers registered with Apple (either inside or outside the Mac App Store). It'd be more secure out of the box than a Windows system, as if you have admin and are willing to click "yes", you can let an application do anything on Windows (although most attacks can be prevented with the new features in Pro/Enterprise).

Windows 10 has identical defaults (Windows Store install only, with hard locks on certain parts of the system and an integrity checker).

All I know is my older and less tech savvy relatives experience pretty much no problems with Apple devices and iOS/macOS. And if they did, they can take it to the Apple store.

Because sometimes they buy a new computer and it is a while before I am able to visit them across the planet and install a new OS in it. Would really like a good out of the box experience.

You don't need to install a new OS, you just enter a Windows Pro license key to upgrade the version? Buy the key online, send it to your parents, tell them where to enter it, done.

Also I don't think your parents want to use that particular sandbox. There's no persistence at all: no bookmarks, no cookies, no history, no local documents, ...

The no persistence is why I like it. It would be ideal if I could ask my parents to do their entire browsing in an ephemeral sandbox and even if they end up clicking / installing something from a shady link it wont blow away their (real) persistent OS install.

Totally get that issue. It might be worth spending a day or weekend making a boot-disk for them that will wipe their current disk image, and install win10 pro with it set-up so you can remote admin it.

That way for your parents they just have to buy the pc, put the usb in and reboot it, and then call you when it's back on so you can remote in and give it a key and finish configuring it for them. I suppose even that might cause issues if you can't teach them or walk them through via facetime how to set the device to boot from the usb instead of the harddrive.