*facepalm*

Flash is only sandboxed to a degree, even in Chrome. It still has full network access and it has disk access, and it has video hardware access, and from a few things I heard so far, the Chrome sandbox is quite leaky due to all the things they need to open to keep Flash working (and not just because of the design of PPAPI, which lets Flash directly access the innards of Chrome). The problem is that Flash is a huge, multi-purpose plugin that does tons of different things all over the computer, DRM being only a tiny piece of it.
What Mozilla is trying to do is getting rid of that huge multi-purpose proprietary thing that is hard to secure and replace it with a small for-one-purpose-only (that needs to have a nice ring for unix-lovers, right?) well-sandboxed-by-design module, so that this CDM module isolates the proprietary functionality better.