I am not an expert, so please do not take what I say here as fact. It is based on my best understanding of what I have read from various sources, most of which I would personally think of as experts.
Partially. The security risk with browsers is that they have to deal with “untrusted input”. That is, any website you visit can serve you pretty much any file it pleases. That includes malicious files intended to exploit vulnerabilities in, say, the JavaScript engine, or the page rendering engine. Browsers are the primary way many people interact with a computer, and they’ve become increasingly complex over the years. Supporting all those features (such as many different image formats and PDFs) means there are a lot of places that there could be an exploitable bug.
I honestly haven’t looked into this one in too much depth, but I think it depends on which kind of sandboxing? My understanding is there are different kinds of sandboxing used in browsers for different things; sandboxing individual tabs limits communication between them, helping to protect data from malicious websites attacking legitimate ones and websites which do not respect privacy collaborating (to some extent). Certain components of the browser may also be sandboxed to attempt to prevent any bugs leading to a total compromise; an example that comes to mind is the C-based GIF library giflib. Google recently decided to use their in-house LLM Gemini to rewrite giflib in Rust (I feel icky about that, but my feelings aren’t relevant), which allowed them to avoid the need for sandboxing as per their “Rule of 2”. Maybe read their page about the Rule of 2, it might provide some insight.
I think that probably depends on exactly how outdated said browser is and what exactly you consider a “non malicious” website (is Facebook “non malicious”? They might not be trying to attack you, but they also serve posts made by other people, which might be). I would generally say the answer is “yes”, it is dangerous. You can’t really be sure that any given website is not malicious.
Yes. Sandboxing is just another piece of code. It can have bugs too.
Putting your browser in a sandbox is generally not recommended because it can interfere with the existing sandboxing the browser does. You should install the native package of whatever browser you use. Firefox has sandboxing too; Chromium is just regarded as doing a much better job of it.
If by “old extensions” you mean literally old: old, unmaintained software may be full of known, exploitable bugs.
If by “old extensions” you mean Manifest V2, my understanding is that Manifest V3 reduces the number of things an extension is allowed to do (as in, even if you were to give it all the permissions it wants). In theory this reduces attack surface and makes it harder for people to make malicious extensions. It also “conveniently” makes adblockers such as uBlock Origin much less effective, which is probably a big factor given that Google is an ad company.
Using extensions at all increases your attack surface and may make you stand out more from a privacy perspective. The fewer extensions you use, the better. An adblocker and password manager are pretty reasonable to have, but it is possible to get many of their benefits without using extensions.