You are using a C++ 'String' object. The String object contains (at a guess) a pointer to a block of bytes (2 bytes), and an offset to the start and end (2 bytes each). This makes it fast to work with substrings of a string.
When you use sizeof, you get the size of the object, not the length of the actual string.
Generally, we avoid using C++ String objects when working on the arduino. Behind the scenes, it uses dynamically-allocated memory to do its work, and that's limited and prone to fragmentation. Instead, we usually use C-strings, which are arrays of byte terminated with a zero '\0'. The C programming language uses these by default, and there are a number of standard library functions which are designed to accept these - see the sticky post
Try this for more info:
char BOX_msg_1[] = "test";
char BOX_msg_2[4] = "test"; // warning! This won't be properly terminated!
char *BOX_msg_3 = "test";
msg_1 is an array of char. The C compiler allocates 5 bytes for it - 't' 'e' 's' 't' '\0'.
msg_2 is an array of char. We explicitly say it's 4 bytes, so a \0 terminator isn't put on it. If you use the library string functions (eg: strlen(), Serial.println()), they won't do as they are supposed to.
msg_3 is a pointer to char - 2 bytes. The compiler creates a 5-byte array of char, populates it with the text and its terminator, and puts the memory address of that array into the variable.