How does OS X's defaults command get access to prefs of sandboxed apps?

try that:

CFPropertyListRef prop = CFPreferencesCopyValue(CFSTR("ElementsVersion"),
CFSTR("/Users/karsten/Library/Containers/com.apple.Maps/Data/Library/Preferences/com.apple.Maps"),
CFSTR("kCFPreferencesCurrentUser"),
CFSTR("kCFPreferencesAnyHost"));

seems you need the path to the file, not just the bundle-id

Karsten’s answer is correct but for the sake of completeness, the defaults command uses the undocumented _CFPreferencesCopyApplicationMap() function to retrieve the full URL of the preferences.

#import <CoreFoundation/CoreFoundation.h>

extern CFDictionaryRef _CFPreferencesCopyApplicationMap(CFStringRef userName, CFStringRef hostName);

int main(int argc, char *argv[])
{
    @autoreleasepool
    {
        CFDictionaryRef applicationMap = _CFPreferencesCopyApplicationMap(kCFPreferencesCurrentUser, kCFPreferencesAnyHost);
        CFArrayRef urls = CFDictionaryGetValue(applicationMap, CFSTR("com.apple.mail"));
        CFShow(urls);
        CFRelease(applicationMap);
    }
}