Because SRT is just wrapper around Seatbelt(macOS)/Bubblewrap(Linux), with some additional stuff. The process runs on the host kernel, which makes it vulnerable to kernel exploits. And you still have to write the config file properly, which is quite annoying in some situations.

While running the Agent inside a VM/MicroVM means you're mainly exposed through potential hypervisor exploits, and potentially to vulnerabilities in your custom Host-Guest interface. Which makes it safer, once you've set it up, it covers a broader set of use case out of the box, unlike srt where you might have to keep changing your config file.

That's my experience after trying SRT and a few MicroVM setups though. I still use both, just for different stuff, but random code always goes straight into the MicroVM.