Do all the containers I launch run in an EC2 VM that’s isolated for my account? Or does Fargate somehow provide the security isolation without being a VM?
Fargate isolation is at the cluster level. Apps running in the same cluster may share the underlying infrastructure, apps running in different clusters won't.
Are they creating separate cluster for each aws account, how the isolation is happening
A customer creates a cluster on their account. You as a customer can create one or more Fargate clusters on your account to launch your containers in.