You can prevent buffer overflows even when you don't use a VM. Eg it's perfectly legal for your C compiler to insert checks. But there are also languages like Rust or Haskell that demand an absence of buffer overflows.

You can design a VM that still allows for buffer overflows. Eg you can compile C via the low-level-virtual-machine, and still get buffer overflows.

Any combination of VM (Yes/No) and buffer-overflows (Yes/No) is possible.

I agree that using a VM is one possible way to prevent buffer overflows.