Scenario:
try to get default printer in sandboxed app
cupsGetNamedDest(CUPS_HTTP_DEFAULT, 0, 0)
when specific default printer is set in System Preferences - Printers.

Expected:
default printer

Actual:
IPP_STATUS_ERROR_NOT_FOUND

What happens:
libcups tries to access ~/.cups/loptions to get default printer
Apple does provide entitlement com.apple.security.print which does allow that
BUT
cups uses getenv("HOME") to get home folder pathwhich returns ~/Containers/{bundle id}/Data under sandbox
while it should use real home folder (getpwuid(getuid())->pw_dir)