Security within a VM (AV, MDM, OS/App updates, MFA, ZT, etc.), that accesses company data, doesn't matter if the host is secured.

No joke, I've seen countless times people wanting exceptions due to being a VM.