IMO it's not that clear-cut. A VM is safer than a webpage which is safer than an nacl-plugin, which in turn is safer than an UAP app. But in the end you risk privilege escalation for everything which isn't airgapped.
Well, now they do have an escape. That useless IE/Chrome exploit might be able to suddenly gain SYSTEM privileges.
You can get compromised by such attacks no matter how responsible you are.