Mike wrote:

Java has that separation built in yet it was breached.

Not on anything like the same scale! Yes, there's been at least one
documented failure in the *implementation* of the Java sandbox. Contrast
that with ActiveX - "sandbox? wot sandbox? you wanna run on my machine?
go ahead!". It's almost as if *design* matters, as well as
implementation ;-)