RSS readers and malware
I'm sorry you felt the response you got on the Vienna GitHub page wasn't satisfactory. The issue was caused by a compromised web server that was serving you an RSS feed and also performing a normal HTTP request to a ransomware site.

To add an answer to your second item, disabling JS and plugins in the internal browser should be more than enough. Attempting to reach a ransomeware site isn't a security issue in itself.

For Sandboxing, Vienna was patched in November 2016 (see https://github.com/ViennaRSS/vienna-rss/issues/736) to prevent an XML exploit that allowed a malicious RSS feed to potentially read files outside of the application. 
We hope to add the macOS native sandboxing in the future and that is an issue that is high on our list of improvements to make to Vienna and hopefully won't be outstanding for too much longer.