I actually never thought of it from that perspective. Can you expand on this? Is the primary threat DOS or malicious DMA ops from external interfaces and device

I actually never thought of it from that perspective. Can you expand on this? Is the primary threat DOS or malicious DMA ops from external interfaces and devices and the primary advantage mitigation by rerouting I/O from that device to a "null" VM?