[Isolation enhancement] Block elevated processes from uninstalling devices

[hg421]

It is possible to run the windows device manager (devmgmt.msc) inside a sandbox (by starting it from an elevated command prompt).

This allows the user to view installed devices, and also provides an "uninstall" option:

However, it looks like the uninstall operation is also possible from inside the sandbox and really removes the device from the system (e.g. removing the audio device disables any audio output, etc.)

It is my understanding that sandboxed processes should generally not be able to make any changes affecting the whole system (and that persist after deleting the box),
so is there any way to block this ability?