One point I do not see mentioned in the article is that some VR world server applications allow world creators to put in "virtual media" players so that people

One point I do not see mentioned in the article is that some VR world server applications allow world creators to put in "virtual media" players so that people can watch movies together in the virtual world. This is a nice feature however potentially comes with both privacy and legal risks as the virtual movie player is often pointed at an IP controlled by a player so they get access logs and it is often hosting pirated movies. There is no way to know that player has disabled access logs. Some of the VR social apps also lack security/hardening so a player can host a malicious-on-demand object meaning they can target specific players that can crash players and get access to their files on their PC. In my opinion these applications really need external sandboxing with security/access policies. Maybe something like firejail or bubblewrap but that works on Windows and Mac. If Valve would implement this around all Steam games I think that would be a great start. Somewhat off-topic from this is the ability to monitor a players eyes and record their iris from the VR headset and limiting who has access to this data. I do see this being discussed anywhere. Some government facilities use the iris as one factor of ID. I do not know if this can be abused but either way I would not want random people having a copy of my iris and more than I would want them to have my DNA.