This does violate the principle of least surprise. But,if you look through their other github issues, it becomes fairly clear that Anthropic are not interested in building an effective sandbox. It's a feelgood sandbox. To be fair, they must have a better focus on Claude not doing stupid things, or they would have crashed and burned by now. Nevertheless, if you want guaranteed limits, then they have to be enforced by external means.