You mean your argument that it is hard to find a vulnerability, despite the fact that commercial systems in Unix kernel lineage have historically been easy to hack and have never once demonstrated high robustness?
You have not even established what level of security you are arguing has been achieved. This is not even moving the goalposts, this is Calvinball.
I contend that a major cloud service, that runs trillions of dollars of commerce is at least as important as a fighter jet. The F-35 demanded a operating system certified according to the SKPP which follows in the heels of the Orange Book Level A1. That demanded a formal specification, formal proofs, and a failed penetration test by the NSA.
Do you contend that KVM has reached such a standard? Or do you argue that such a standard is too high? What standard should be expected? How do you verify such a standard has been achieved? How does that trace to operational security goals?
The operational security goal commerce needs is for the expected value of an attack to be unprofitable. How are you verifying your axiomatic arguments are moving that needle?
Thinking that everything is insecure and all that matters is “better” is not even binary thinking, it is unary thinking. There is no meaningful discussion to be had until you:
1. Establish a measure and level of security that matches operational goals.
2. Demonstrate proposed mechanisms empirically achieve such goals or have a track record of achieving the desired level of quality such that the reputation may provide some coarse substitute for evidence.
Until that point it is: “Dude, trust me. I have been wrong every time before, but I totally got it this time.”