Note though that QEMU's security boundary only covers running with KVM (see https://www.qemu.org/docs/master/system/security.html https://www.qemu.org/docs/mast

Note though that QEMU's security boundary only covers running with KVM (see https://www.qemu.org/docs/master/system/security.html https://www.qemu.org/docs/master/system/security.html). So if you're running without KVM, ie using TCG emulation, you should either only run guest code that you reasonably trust to not be malicious, or run the whole QEMU itself in some kind of sandboxing.