I wonder if this can be circumvented by running Dota in a VM.

Not helping as long as the page fault is triggered and handled by the process. You could just not do a regular read of the page though. No need for a VM for that, just call VirtualQueryEx and check MEMORY_BASIC_INFORMATION.AllocationProtect for the PAGE_GUARD flag.

It could be bypassed by running the cheat outside the VM.

Of course, there's plenty of detection techniques for VMs too.