You can also think of virtualization in terms of redundancy. If you can break out of userspace and into the kernel, you now have to break out of the hypervisor

You can also think of virtualization in terms of redundancy. If you can break out of userspace and into the kernel, you now have to break out of the hypervisor (which has a smaller attack surface) in order to escape a very constrained environment. And by hypervisor I really mean the kernel module, because the device emulation is also running heavily constrained through pledge/seccomp/SELinux/whatever.