We think of these as deployment abstractions that provide no security value. This is why services like Amazon’s ECS Fargate pair 1 task definition (usually a single container) to a single EC2 host for isolation.
Like most good stories, there's a beginning, middle, and end. We're in the middle now, and Fargate uses both regular EC2 instances and Firecracker in some cases.