This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

Which is the entire premise behind Qubes: https://www.qubes-os.org

This argument is only similar if the condom is known to have huge design flaws

VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.

How can you honestly think VMs are the most secure form of isolation?

Sure, in theory. Are there any current exploits for VirtualBox?

The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

Unsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox:

* http://arstechnica.com/security/2015/05/extremely-serious-vi...

* http://www.securityfocus.com/archive/1/495095

* https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv...

* http://www.coresecurity.com/content/virtualbox-privilege-esc...

"Requires a 0-day" is still a huge barrier. It's not 100% secure, sure, but it's an improvement.

Yeah, not arguing that. Just don't treat it like a panacea

Yes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.

More secure than without though.

Lets try to avoid treating security as something binary.

Yes but if you run a compromised App in VM A and have your sensitive data in VM B then they have to break out of the VM A and then break into VM B. It's no longer worth the effort. There are often easier ways like phising.