The author fails to define "VM" here. The only thing that makes sense is "Virtual Machine," which is a thing, but only barely makes sense in this context.
The fact that node operators have little incentive or ability to inspect or reject changes to contracts beyond what the protocol dictates isn't a problem in itself. That is, after all, the entire idea. Code is law. It doesn't matter how desperately a single miner might want to change the rules. At least in principle.
This is more of a problem on systems like Bitcoin where miners of side chains literally have no knowledge, from the protocol itself, of what the hashes representing transactions on other chains mean.
The bigger problem, not addressed in this article, is that the vast majority of things you want to do to make a block chain useful outside of financial transactions requires something called an "oracle."
What does that NFT actually secure? Go consult the oracle. Want to know the exchange rate of some non-ethereum token? Go ask the oracle. Want to know what that land title says? Go ask the oracle.
The problem is that an oracle is just a server. Maybe it's a group of servers - doesn't matter. Servers are corruptible in ways that Ethereum is not (or at least should not be) through hash chains and proof-of-work. Servers use logins, admins, and undocumented security procedures. And they offer little protection against Sybil attack.