For some reason I can’t get behind, this feature requires some virtualization mode with lowered security features.

The usual virtualized devices like network cards (that are already supported by Linux distributions like Debian) work by the hypervisor intercepting memory access to certain memory regions. Perhaps it’s not viable to support these with the secure approach where the VM is protected from Android.