A sandbox readonly or read-write entitlement is an additional requirement that must to access the filesystem when running under the sandbox. For any item outside of the applications container then the application must be granted a readonly or read-write entitlement - either statically via the entitlements compiled into the application or dynamically by the user selecting a file or folder - and the user must have the appropriate filesystem access right to the filesystem item.
For example if the user grants your application read-write access to another users Public folder using a standard file dialog, that does not change that the user can only read the contents of Public and write to the contained Drop Box folder.
Subject to the requirement for an appropriate filesystem access right, a user granting sandbox access via a standard file dialog to a folder is granting access to the whole file hierarchy rooted at that folder.