To add a bit to what Aram's saying, I don't think that you need to "change your mind" with respect to the Sandbox, but distinguishing between classes of features might help.
• Things that help prevent reidentification help.
• Things that support purpose-limited functionality without effecting a revenue transfer between contexts (eg. attribution) help.
• Things that transfer value between contexts (Topics, some of FLEDGE but that's complicated) hurt.