> All less than Linux process isolation, but still.

.... Right. Exactly. Everything has some vulnerabilities, but if an attacker has to use a relatively rare VM escape, that's a huge win.