This answer won’t make you happy because it won’t match government check box security.
First of all, the 3 Pass Wipe derives from a decades obsolete MFM disk technology that no one uses. It makes no sense on modern disk drives. Yes I know – government rules.
The same type of issue occurs with an e-mail “spill”. No one is going to wipe the main email server drive due to an individual “spill”. Instead the affected accounts will be manually sanitized and sometimes if the spill is bad enough, a free-space wipe on the server will be performed.
Similarly to the email server, depending upon the severity of the issue:
The VM disk file can be manually cleaned and compressed
The VM disk file can be wiped
The ESXi hard drive can have free-space wiped after VM deletion/wiping.
3 Pass Wiping of a VM is just security theater, but it may check bureaucratic boxes.
None of this meets Old School remediation standards, but times change and even the government has to change.
Throw in the likely possibility that the VM virtual disks may actually reside on a virtual LUN from a RAID array of physical drives in a SAN and Old School goes right out the window.