Developers do need a sandbox, but they also need to maintain control of their dev environments. Too often they don't know what they changed to get something working, or they don't "undo" a previous change somewhere before making another one. That results in not an experimental system, but an unknown one.

I think Devs should have a person VM for really new changes and experiments, but either they or a DBA needs to maintain some control over changes in dev. Not to be too much of a protector or "lock it down" person, but to ensure those changes can be replicated later.