arp BSD tool is opensourced by Apple.

Yes, it's a Developer ID application with NE extension. We use auditpipe to detect user login/logout events and as far as I know Endpoint API doesn't help with those. We will use Endpoint Security at some moment in future, but not at the moment. Even if Endpoint can or will have support for such events we need auditpipe in any case to support older macOS versions. Turning sandboxing off is possible, even though it feels like a step back and I'd rather keep it.