I’ll get IT on it STAT! Regular employees going to love accessing PDFs in a VM

Honestly, it's possible to make VM windows show up as if they were normal programs, or you could just do things like Chrome-level internal sandboxing. There's no reason this has to be clunky.

Adobe Reader is already sandboxed a la Chrome.

According to Zerodium prices, VM escape costs as much as LPE, so it is unclear if there will be much of a security improvement beyond 2x.

Although virtual machine hypervisors don’t automatically update, unlike Adobe or Windows.

I am pretty sure that hypervisors update just like any other software, via the package manager.