[Samsung Galaxy S7 Edge Questions and Answers] MR_ROBOTTT:
Why KNOX cannot be installed in SD card is an interesting question. And yes, this is due to security, limitations and incompatibility reasons... Let me explain what this means..

So basically KNOX is an encrypted space which is specifically made for business needs. We use KNOX in our company in order to sync our business email (Outlook) with the smartphone. So speaking about early 2000's most favored business smartphone was Blackberry. This was due to additional security layer provided by the blackberry operating system. Including remote data wipe feature which is mandatory to configure (to trigger in case of data theft) with the company when configuring their business email account.

During year 2014 and around android and iOS operating systems started dominating due to extreme security standards (software and hardware). As a result most companies allowed configure business email accounts with Android and iOS devices. However still we had to give them complete Device Administrator rights for the purpose of safe guarding data and wiping complete device upon data theft.

As a solution different phone manufactures like Samsung, platform developers like Android/Google and iOS/Apple started implementing different security mechanisms to keep up with business security standards. KNOX is one of the best ideas among business security. KNOX is a secure and isolated space (Virtual Machine in other words) which is designed to keep up with these security standards. This is like encrypted android operating system running top of another android operating system. Isolation between two operating systems gives an extra mile security. Also on a data theft wiping the VM could satisfy the business security measurements. Also in an android smartphone internal memory (where the operating system is installed) is on ext4 while external storage is on mostly fat32 (this gives the capability of plugging into all most all operating systems). However we cannot install KNOX the android VM on a fat32 file system. This VM needs to run on top of Android since the implementation is written in specifically for Android. Therefore knox needs to lay within ext4 partition's android operating system.

We can think something like this.. How about formatting external fat32 storage to ext4. And merging both partition and create a single one. Install samsung's android operating system on top of this merged partition. Then use Knox within this. (this has never been implemented, jut imaginary). But then again knox is not just an app running on android. It is a VM container which contains android application within it). This basically works like an operating system with applications. Running an operating system on a SD card is not feasible due to low data transmitting speeds. Eg: Most SD cards out there does not support straight away 4K/Burst Shot capturing to SD card due to low speeds. So can android operating system run on it? Android operating system transmit lot of data to keep the operating system up and running. This transmitting data includes hardware software instructions which keeps network, sensors, mic, speaker, display and every bits of running blood beneath android.