That's possible, and addressed by your first sentence above. You wrote the second sentence to address a different possibility. In that case, a process with access to the whole device could read e.g. auth tokens contained in a VM.