Or perhaps this illustrates the value of running all web services under KVM rather than bare metal.
Or the value of not running linux everywhere.
Regardless of the OS, kernel, or program you select there will inevitably be holes in your stack. A VM will always provide better isolation and more flexibility. In this instance it would mean being able to patch the box running the service without messing with the driver for the backing storage.
Depends on the VM system. Full blown virtualization add complexity and attack surface. Running vmless[0] could be even better if you trust the design of the isolation enough.
Anything important should be virtualised and regularly snapshotted. Nothing is invulnerable but if it can be reconstituted in an hour, that’s close enough. If it isn’t and you care enough then a standby server with failover should take care of it.