Yes, but theoretically those applications wouldn't be able to do anything else than modify the data that you're uncompressing, which simply means that you have

Yes, but theoretically those applications wouldn't be able to do anything else than modify the data that you're uncompressing, which simply means that you have to decide whether you want to trust the data that you uncompressed. Now of course there may be exploitable vulnerabilities here, but just as in any other piece of software. So no, just because this runs a VM doesn't mean it's intrinsically more dangerous than anything else. Basically just any program that takes input from the outside world (a PDF reader, an MP3 player, you name it) is vulnerable to attacks.