I led the portion of this project on Borg itself. Security team did most of the security infrastructure, and coordination among almost every large infrastructure system team inside TI. I'll be waiting for them to answer any questions. :)
I've seen references to gVisor being used 'in production' for google app engine && cloud run and so forth. Scanning through recent commits && the github repo this is clearly not the case - there are way too many outstanding issues and outright missing support for various things. Is this another project where it was written in a different language or something and then ported out? Can you clarify?
As a bystander from outside, I generally don't like VM type of mechanism as security mechanism. Unless it's actually a VM hypervisor. That way hardware can be utilized to define a relatively simper and more robust security model. (Of cuz, not saying hardware is always superior please don't chase me on this direction).
On the contrary, true software sandbox like ebpf and webassembly with limited capabilities in its building blocks and clearly defined application scenarios, are better ways to do security in software.