Heuristics require you to be able to monitor what the malware does, malware detects monitoring techniques such as debugging and sandboxing/emulation.

Heuristic analysis can help you determine if a binary is doing something fishy before you can figure out exactly what it does, it won't help you bypass evasion.

That said an application that doesn't run in a VM is a telltale sign of malware, which is why malware that truly wants to hide would still run but do something completely different.