I would argue that it's still safer, even though it's not completely safe. You shouldn't view any sort of security measure as perfect, but that doesn't mean th

I would argue that it's still safer, even though it's not completely safe. You shouldn't view any sort of security measure as perfect, but that doesn't mean that using good practices doesn't contribute to better safety. Using your example: attackers being reduced to performing side channel attacks after owning a VM is better than them having direct access to the host machine itself (using the same exploit), even if it's still a security flaw. Defense in depth is a good idea, even if it's not perfect. (Note that your argument goes from "not entirely safe" to "not safer", which doesn't logically follow.)