Can sandbox users upload their own plugin or theme files into my sandboxes?

Yes, by default, sandbox users can modify, add, or remove plugin and theme files.

WP Sandbox does not prevent sandbox users from adding, modifying, or removing plugins or theme files, but you can certainly take steps of your own to control this.

As the sandbox owner, you can control access to certain normal WordPress capabilities by using the Admin Menu Editor plugin to disable the menu items and features in your WordPress sandboxes that you’d rather your demo customers not have access to.

You can read more about this, here.