There's no contest between physical vs. virtual isolation. Theo de Raadt and @thegrugq are right when they're saying you shouldn't put much trust in virtualisation-as-isolation model. Just look at the recent VENOM bug.