Yep thats what I meant. But also imo templated VM or Containers are not aimed to be not break-out safe. This is the case for this though, which why I think it would not be fair to it to set it side by side to a normal vm template or container. Besides that it also brings some nice added bonuses, some of which you listed.