No. Sandboxes aren't overrated. They've very useful. They are not a silver bullet -- they don't solve every security problem -- but they do have substantial value.
Really, don't think this is especially new. If you read the original paper describing the Chrome security architecture, it clearly explains why sandboxing is valuable while also elucidating its limitations. For instance, the introduction says:
Chromium's architecture is designed to mitigate the most severe vulnerabilities, namely those vulnerabilities that let an attacker execute
arbitrary code. [...] We find that 38 of the 87 rendering engine vulnerabilities allowed an attacker to execute arbitrary code and would have
been mitigated by Chromium's architecture. These account
for 70.4% (38 of 54) of all disclosed vulnerabilities that allow
arbitrary code execution.
So Chrome's architecture makes a huge contribution to mitigating the most severe vulnerabilities that one can have in a browser.
At the same time, the Chrome team never claimed that sandboxing is a silver bullet. For instance, see "Out-of-Scope Goals" in that paper for a lucid description of some vulnerabilities that Chrome's sandboxing architecture does not attempt to mitigate. Anyone who has been following this should already be aware of the fact that sandboxing does not claim to stop all security problems.
Read the paper here:
Please remember, vulnerabilities that let an attacker run malicious code on your local system (also known as drive-by downloads) are the most severe kind of vulnerability. An attacker who exploits such a vulnerability can also attack all of your data "in the cloud" or on servers. The reverse is not true. Consequently, drive-by downloads are the most severe kind of vulnerability to have in a web browser.
If you look a few years back, these "drive-by-download" vulnerabilities in browsers were very common. Given their severity and prevalence, it is only natural that researchers and security professionals spent a lot of energy looking for ways to mitigate or eliminate those kinds of vulnerabilities. The security community has found reasonable ways to significantly reduce the prevalence of such vulnerabilities.
So, sure, once you make good progress on eliminating the most common, most severe vulnerabilities, it is only natural to next start looking at how to address the next-most-serious problems. But that doesn't mean sandboxing is "overrated". And, it doesn't mean that the energy put into defeating drive-by downloads was wasted or misplaced. It wasn't. It was important, and remains important today.