What are you talking about? XUL Runner didn't get a release in five years, and XUL is being removed from Firefox. And where did you see Mozilla wants to "ditch app sandboxing"?
Other Browsers have support for PWAs, including Safari/WebKit, which means that it's as simple as --pwa=url to ship your offline ready application.
In Firefox, however, it still requires an application.ini file and an xul:webview to do so. XUL cannot be removed as long as something like a simple webview isn't possible. And something like --pwa=url via CLI is pretty much the correct way to offer this type of featureset in my opinion; as all other Browsers (read as: really all, even Edgium) have support for PWAs.
WebKit, compared to Chromium, has due to the availability of its bindings (like webkit2gtk) even better sandboxing capabilities; with an isolated userdata cache and an isolated webdata cache that you can set to e.g. /tmp/websandbox.
Trident, the old engine behind Internet Explorer, also had this kind of featureset; similar to how WebKit's bindings are built...which is the reason why they still stick around on Windows WPF based apps, and probably is the reason why Edgium and Chromium are working so much on the CEF (Chromium Embedded Framework) in order to replace it.
Additionally, firefox's profile manager concept doesn't allow to fully sandbox a web application in /tmp - not even with an XUL based webview, because it'll always leak out settings in various ways (on Windows, on MacOS, and on Linux).
If there is no alternative to shipping apps via electron and chromium PWAs, there unlikely will be an open alternative that works everywhere.
I honestly don't understand this decision.