hey, has anyone experienced an issue with their sandbox site being indexed by search engines?

If Google finds a link to it anywhere, it'll index it. You need to add a robots.txt in the web root folder to avoid this.

so I have that there already. I think to be safe I also need to password protect my sandbox site, but I am not sure how to go about that

Google honours robots.txt directives pretty reliably, so if you have it set to exclude, you should be OK. If you're that concerned about it, switch your DNS to Cloudflare and add firewall rules.