The code snippets are purely declarative because they are reconstructed from the simple bytecode that the macOS sandbox library generates after evaluating the Scheme code. At that point any abstractions present in the source code are long gone and only predicates and actions remain.
If you look at typical SBPL source code you'll see it tends to contain a mix of straightforward, declarative `(allow …)` policies and custom functions/macros used to simplify repeated patterns. See https://github.com/WebKit/WebKit/blob/11b5279aec6113c661dac3..., for example.
JSON and xml are both data representation formats, but the code snippets in the article seem more like a declarative language.
You could make a declarative language using JSON semantics, but maybe they wanted something more bespoke.
it’s also super duper easy to write an s-expression parser