To me it sounds like it might incur a lot of overhead for minimal gains. At the end of the day you are trusting both the software and hardware implementation fo

To me it sounds like it might incur a lot of overhead for minimal gains. At the end of the day you are trusting both the software and hardware implementation for isolation when using virtualization. Virtualization comes with a substantial relative performance penalty. In an ideal world, where virtualization has no performance penalty, it might make sense to wrap everything in VMs but in the real world I think having the option to switch isolation mechanisms might be the best idea. Some may need "better" (subjective) security and opt for VMs which could be the default platform. Others may be fine with something more lax like gvisor or even just having different users for each namespace.