If you're running a VM you're storing the whole state of the VM on the host machine, there's nothing technically stopping you from copying all the data, and worse, there's no way to even know that it happened.

What VMs are helpful for is cross-contamination and spyware attacks from other clients a contractor is working for.