Doesn’t “virtualization-based security” mean everything does, container or no? Or are they actually VMs even with VBS disabled?