Attack surface of a minimal hypervisor is way smaller than that of an entire kernel.

Take a look at Clear Containers (despite the name, actually using VMs) and their qemu-lite minimal machine type.