> Security theatre. If your browser is attacked by an 0day of any sort, or malware or whatever, it will have access to the shared credentials and information inside your browser.

Yes running a VM won’t protect against this threat.

Running a VM will pretty much eliminate that 0-day from infecting the host OS, where it could become a persistent threat and have access to a range of sensitive data.

This is not security theatre. You just have incomplete threat modelling here.

https://www.securityweek.com/chrome-sandbox-escape-vulnerabi...

Web browser sandbox escape just by viewing a HTML page. Not common, but it happens.