That makes sense. But every security bug starts as a zero day. But yet some bugs become common malware, yet I others are not. Why? And is virtualization some

That makes sense. But every security bug starts as a zero day. But yet some bugs become common malware, yet I others are not. Why? And is virtualization somehow special in that regard?