When all is said and done, I think it is appropriate to reference the Google Sandbox as an effect and a situation, rather than an explicit penalty enacted by Google.
I think there are two forces at play:
1) Google doesn’t want brand new (unproven) websites to cause volatility in search listings.
2) Google doesn’t want to miss the opportunity of not prioritizing a website well that might be very relevant to user queries, even if it is new.
For these reasons, my conjecture is the following:
1) It takes brand new websites some months to be indexed (assuming no aggressive link popularity tactics are being used) simply because there are 50 datacenters and thousands of computers that control the Google index, and it just takes time to synchronize all of them.
2) Once sites are properly indexed, Google may, for a small period of time, artificially boost a site’s rankings past what they might deserve for their given PageRank to assess the click thru rate of the site’s various listings (in other words, see how appealing the listing is to its users relative to other listings in the index). This probably only happens for the more popular search categories.
3) The listing will eventually fall if it does not get enough clicks to justify the artificially high positions (or PageRank) Google has given it. Conversely, the listing may rise if justified.
Appropriate link popularity tactics are valuable for two reasons:
1) Help the Google spider find the site more often.
2) Show Google that the site is growing in popularity based on the number of increasingly relevant links it is garnering.
That’s just conjecture and analysis based on all of the competing views i’ve heard.
Some interesting links:
Search Engine Journal: Matt Cutts (Google Engineer) confirms the Google Sandbox exists
Blog Business World: Google explanation of what the “Sandbox” is.