The virtualization layer becomes a single point of concentration for both security and attack. That offers opportunities to reduce the attack surface and opportunity.

Net net, given the choice of extensive plug-ins vs. virtualization, I'll go with the latter.