It is generally assumed virtual machines have better isolation (security-wise) than operating system level isolation like the containerization Mesos and CoreOS are making use of.
CoreOS and SELinux together is pretty secure if set up properly; even if you broke out of a container you wouldn't be able to do anything, even start a process. But still, yeah, in a unikernel there is no 'breaking out' at all.