GAE appears to be an evolution of Google's internal platform which does not use virtualization. Why invest in learning about a technology that is very different from Linux when such knowledge would not benefit 99% of Google's workloads? Given the number of kernel developers at Google, if they want security I would expect to see them improve Linux rather than adding virtualization.

Of course, Google now has virtualization (GCE) because some customers demanded it, but if GAE already works there's no reason to redesign it.