The problem is largely in the effectiveness of the dynamic analysis. How do you define malware? What does malware always do that normal programs never do? (Hint: there is no answer to this question)
Well-written malware can look innocent and perfectly legitimate programs can look dangerous.
Here's a simple example: the malware might try to join your computer to a botnet. So the dynamic analysis is looking for new outgoing connections? Well what if it's time-delayed? You won't catch that and you'll still serve it up to the user. So you look for code that will initiate a connection? What if it's a legitimate app that initiates connections to a server?
For almost any example, you can come up with either a way to circumvent detection, or a legitimate use case that would be blocked.
It's more effective to sandbox - to restrict the permissions of components that are likely to be compromised. For instance, don't allow your browser tabs (which are separate processes in something like chrome) to have filesystem access. Even if a tab-process gets compromised, it can't write malicious files to your disk (without prompting you for permissions)