Who is running sandboxed untrusted Python code?

JS has a completely different threat model. And PHP has just been a basketcase from inception.