Vim, Emacs, and Sublime would all be similarly vulnerable.

To sandbox them away from the editor contents? I can't think of many of my (Vim) plugins that would work without access to the editor itself.

To sandbox them from network and or disk access.

No, they're executable code with full access, just like in basically any other editor.

Sandbox that keeps them from your filesystem - maybe. But not from the editor or network (most of the plugins need or rather based on the idea of using them).