Yes and no. If the VM has network access you can still royally fuck yourself. Also, it’s possibe your virtualisation software has a vulnerability—that way it may still infect your host machine.
More often than not VMs may protect you, but it’s no guarantee.
Imagine paying to get tapped. Never been fond of all these smart home gadgets, although I do love the features it offers. I’d buy one in a heartbeat if it wouldn’t be so privacy intrusive.
He eventually found the executable by Googling for it online and is now part of a botnet.