Using VMs like this means the VM itself becomes hard-core security-critical but if apps have stupid bugs their damage is quite limited. It also means you can m

Using VMs like this means the VM itself becomes hard-core security-critical but if apps have stupid bugs their damage is quite limited. It also means you can mitigate things like Spectre or RowHammer by just tweaking how the VM JIT compiles bytecode into machine code. You don't have to update apps or even the kernel per se (though the latter would be a good idea).