It’s up to the virus database to decide what to submit (provided the user has the “community” option enabled). It doesn’t have anything to do with the final user’s choice (whether to use the sandbox or not). It may also be enabled only on a random fraction of the users (that is, if it doesn’t submit anything from you, it doesn’t mean there isn’t anybody else who gets the submit under the same circumstances).