One good aspect is you can keep your VM "cold" while you continue to use your PC normally and the VM is then sandboxed in a way, however if your PC is fully compromised the attacker could potentially be able to spin up the VM.
I could say you might get a mass trojan that would scan for known wallet instances and that they would not notice and and therefor not report back any wallets on your PC, since its hiding on a VM. But if someone knew you had a large wallet on a vm and they were trying to target your VM wallet specifically they could probably work their way in.