I think the point being made is that given an organisation/entity that runs a whole bunch of stuff on a bunch of VM servers then, theoretically, the most important VM on a VM server (with regards to security/encryption) is now only as secure as the least secure VM that runs on that same VM server.
Rather than try and hack the nailed down, up to date with patches, regulary checked/scanned/etc payment processing VM with lots of credit card info directly it's easier to pick off the forgotten about unpatched VM on the same host that someone spun up to do a bit of testing and then promptly forgot about.
IOW, if you're in control of it, don't run really important stuff on VMs shared with a whole bunch of 'other' VMs, or make sure that everything you run on a specific VM host is equally secure.
Rather than try and hack the nailed down, up to date with patches, regulary checked/scanned/etc payment processing VM with lots of credit card info directly it's easier to pick off the forgotten about unpatched VM on the same host that someone spun up to do a bit of testing and then promptly forgot about.
IOW, if you're in control of it, don't run really important stuff on VMs shared with a whole bunch of 'other' VMs, or make sure that everything you run on a specific VM host is equally secure.