How do modern mobile operating systems sandbox applications to prevent unauthorized privilege escalation and malware persistence after a compromised app is installed from a third-party source?