It is a potentially unsafe app from some random person that can backdoor your computer so it doesn't make sense to run it without a VM.

I mean, sure, that's not wrong, but at that point, why are you letting the random person's app send and receive WhatsApp messages on your behalf at all? I'm pretty sure you'd need to give it network access, at which point being in a VM isn't going to protect your data from getting exfiltrated.