Sandboxing is an excellent default, but the lack of permanent, specific exceptions when they're genuinely needed is what blocks whole categories of apps needlessly. (Your mother is probably not likely to download a pro FTP client.)