It requires an injection first and foremost, the sandboxing stops any foreign entry from entering the main system.
And yes, you are right.
As for the Takeover system, it forces entry first then overwrites- In the same way that if I had access to your computer I could install a new OS without first needing to get your old one to recognize me