Even if we accept the premise, I'd rather use software that contains hard-to-find bugs than easy-to-find bugs, all other things being equal.

In my experience of casual usage VMware is less buggy in general (no random crashes, etc.), and that usually translates into fewer security bugs too.

But if your adversary is spending $$$$$ on vulns to throw at you, you can probably assume they can vm-escape either one.