having worked with AWS, xen had a lot of very bad vulns over its lifetime as well.

there's no magic.