Why is the author conflating a virtual machine (a deployment mechanism) with security?