I have no clue what’s meant by “without download”, but this app just uses web assembly to inspect the archive in the browser. The sandbox they talk about most likely refers to the browser sandboxing.
So it pretty much boils down to “risking running malicious code is fine, because this app as a whole is treated as malicious by the browser”.
On the 8 series and up. Apparently the Tensor and Tensor G2 are too weak to handle this feature or something /s