You're right - if they're zero day. If you don't update your VM and someone lugs some old ones around just to see you could still get bit. Like I said though, odds are actually very low and it's probably not as major of a concern as many people make it out to be.