This would not have been possible with seL4 virtualization.

There, VM exceptions are turned into messages for VMM, which is unprivileged, and has capabilities that do not exceed those of the VM itself.