I am reading about sandboxing, specifically for Android and Linux based systems (like snap apps). Each app is isolated and can only see its own files, i.e. each app has its own environment. What I don't understand is why can each app see all network traffic being sent? On Android I can install HTTP Canary which works by being a VPN and then allows you to see all traffic sent from your device. On my PC I can use Wireshark and monitor all traffic sent from my computer. My question is, why is this possible? Why do all programs have the ability to see all network traffic? Shouldn't true sandboxing result in only each app being able to see its own network traffic? I am thinking that it's because all programs have access to the network adapter, i.e. all programs should be able to use the network adapter, and thus each program can see everything that enters and exits the network adapter. Wouldn't it be better if some form of channels were used, so each app can only see its own channel in the network adapter? I know that as soon as the traffic leaves the device, every device nearby can monitor the wireless traffic, as it is in the air (it's encrypted however). However it's only before it leaves the network adapter that I don't understand, why all programs can see all traffic.
Sniffing network traffic is typically a privileged action. An unprivileged user does not have the ability to perform a packet capture by default.
You have outlined two scenarios (HTTP Canary and Wireshark) that require special privileges. In the first case, HTTP Canary must be explicitly enabled as a VPN by the device owner. An app cannot obtain this privilege on its own, and a user should not grant this privilege to an app that they do not trust to view all of their traffic.
In the second case, an unprivileged user cannot sniff using Wireshark without extra privileges. On Linux, this means being a member of the system "wireshark" group, or running it as root. On Windows, I believe this requires a driver installation that needs administrator privileges.
Since it requires extra privileges anyway, I don't think it really is a concern related to sandboxing. To conclude, packet sniffing is not something trivial that any application can do without acquiring special privileges. Even then, lots of traffic will not be visible since HTTPS is used almost universally.