How do sync programs get around the iOS sandbox?
They can't as all 3rd-party apps on a non-jailbroken iOS device are limited by the sandbox, both installed from the App Store and from ad-hoc/enterprise distribution.
Either they are using public APIs to access data 'the iOS way' (structured and anticipated) such as accessing the Camera Roll to import/save photos, or are integrated with an app to share data in a way that the developers of both apps have worked together to make it happen (this doesn't necessarily mean they actually know each other as they could have used a framework, such as the Dropbox framework).