As MiatoHatola pointed out, moving possibly infected files from the VM to the host system exposes the host to all the dangers the VM is exposed to. You can migitate that danger, for example by automatically scanning files in the shared folder, or by removing most software from the host that would be used to open these files. For example, you could remove the web browser from the host system, which would force your mother to use the VM to browse the web (humans are lazy; she will forget to open up the VM if she can just run the browser on the host) and remove all browser exploit attack paths from the host system.
Thinking about this a bit more, you might arrive at the conclusion that it makes more sense to do certain tasks entirely in the web browser VM, and other tasks entirely in the host. This will reduce the number of files your mother must shuffle from VM to host. Then you might think about moving all tasks to special VMs: For example, there might be a VM for everything that's untrusted, e.g. web surfing, reading mail and looking at documents downloaded in the untrusted VM, and a VM for everything else that's network related, but trusted, such as E-Banking, and yet another VM for doing stuff that doesn't need network access (personal finances, writing letters, doing your tax returns etc). For this VM, you can remove the virtual network interface so it can't possibly connect to the network. The host would just be there to start the VMs.
The advantage of this is that you reduce the attack surface significantly, because you isolate tasks from each other and reduce the amount of data that must be exchanged between the VMs. Also, if malware such as ransomware actually makes it to one of the VMs, you will most likely notice it before it can spread to every other VM. So the damage stays localized.
The disadvantage is that it makes working with the computer more difficult. Your mother will need to remember which VM is for which task, and she'll need to put up the discipline to use the correct VM for the task at hand. You can enforce some of that, for example by making the firewall only connect to trusted sites from your "trusted network VM", and by controlling which software is available in a VM, but it's still a bit of a hassle, especially when she wants to do something for which there isn't a clearly defined task boundary.
Qubes OS is an Operating System built on this idea, and tries to streamline the involved workflows, but it's probably not something your mother is going to be happy with.
If your main point of worry is another ransomware attack, diligent backups are a much easier solution.