My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well run the agent on dedicated VM with antivirus and disk encryption and just forget about it. Theater is theater. The audience would be the same, and they would see the same Play. However, it would not be ethical. It wold also lower my local security, as it's not impossible for malware to escape from a VM to the host machine. (I have worked for a VM vendor. I know a thing or two about VM's).
I have reasonable good security on my devices. Complying faithfully with this requirement would lower my security. If I silo it in it's own LAN, on it's own hardware, it would lower my job satisfaction and my performance.