If you mean running the VM locally, then that has a risk of any exploits being able to escape the VM, and attack your machine directly. That seems less secure

If you mean running the VM locally, then that has a risk of any exploits being able to escape the VM, and attack your machine directly. That seems less secure than facing the risk of any exploits being able to escape the hypervisor in the cloud, someohow come through the text protocol connection to your computer, and exploit you there. The extra layer of security provided by the remote cloud is important. If, on the other hand, you mean using Guacamole to connect to a desktop running headless in the cloud, I'd say that's a similar level of security to BrowserGap.