For the snap, the developer of the snap has to manually list exceptions to the sandbox. That sounds tedious to me.