Just a guess :- Maybe the decryption needs to happen through means present on the device and not in any old VM. Maybe the decryption requires multiple keys :- t

Just a guess :- Maybe the decryption needs to happen through means present on the device and not in any old VM. Maybe the decryption requires multiple keys :- the 4 digit code, a per-device key, a per-session key generated on every boot-up, etc. And they all could be stored such that they never leave the h/w making sniffing difficult.