It all becomes a religion to some people. hypervisor escapes are a thing. People always point to Vt-x or AMD-V as having stood the test of time, and that might be true, but the software layer on top certainly hasn’t. Yet you will have “security professionals” tell you that you can’t trust anything beyond a hypervisor. Or they might tell you that a user space kernel is just as secure. They might tell you KVM is a no-go because of bad Type1/Type2 hybrid architecture compared to Xen or HyperV Type1. All have had their fair share of vulnerabilities over the years. All less than Linux process isolation, but still.