Exactly my thought.

If you get access to a VM, it's not a "security vulnerability" if you then have access to that VM. This was the whole point, the product.

It's almost like returning a car after you bought it with the reason "When I open the door with my key, the door is open and anyone can get in".