It depends on the hardware and usage.

For older computers, virtual machines are too demanding.

As for escalation hacks: they happen also on virtual machines. Check virtualbox and vmware cve's.