They do but not by a significant margin these days.
The kind of domains where this is an issue isn’t what you’re average engineer would be concerned with.
Where VMs do help the average engineer is they have more secure defaults. It’s pretty easy to accidentally run containers insecurely on Linux (FreeBSD jails are a better story though)
