It's not trustworthy unless it's physical separation on a dedicated, energy-gapped device. That's Clive Robinson's term for having as much matter and energy isolation as possible to prevent known and unknown side channels. Anything less will get hacks and leaks.

In fairness, VM escapes are found with some regularity.