there is no plausable deniability if it does something different in a VM. that takes active coding to set up, there is no reason anyone would ever have any code that has this effect.
Some abuse this to make speed tools run faster, ala Graphic Card tests that run faster when it detects NVidia/AMD... some abuse it to skirt protections in VMs...
Do we need to ban torrents because a lot of torrents are illicit materials? Ban bitcoins, because some people use it for drugs? Ban tor?
VM behavior or not, asking or not, I've hoped they get in legal trouble for this as soon as I knew about it, but of course, IANAL.