Basically her approach is that 1) secure by design is too hard to achieve 2) isolation is what matters since each component, "secure" or not, in an OS can break. 3) SELinux and other similar systems are too fine grained for a normal user, thus VM per security domain is one solution.
It's a really pratical approach to security, but probably highly effective for the end user.