Seems like that really depends more on calling conventions than an ABI overall?

Calling conventions are part of the ABI, no?

And usually forbidden in modern sandboxing.

Sandboxing has almost nothing to do with (and does not prevent) function hooking.

True, they are orthogonal.

However Windows, xOS and Android sandboxing are relatively restrictive in that use case.

How so? With dynamic linking function hooking is not all that difficult.

For the stuff that comes with your own package sure, but don't expect to override all the OS libraries without eventually get the process killed, like trying to use DLL injection and OS Hooks on Windows.