Well, they have control over the application, and whatever its VM has access to .. which is supposed to be limited to only the things that the application needs.

Point raised in the TFA is that one process unikernal has a much smaller attack surface than a linux instance running the process would have.