That makes sense.

But every security bug starts as a zero day. But yet some bugs become common malware, yet I others are not.

Why?

And is virtualization somehow special in that regard?