Simply running basic image recognition on a low-resolution, low-framerate video to detect the keys being pressed via an on-screen keyboard would not degrade performance, so it is a practical attack against virtual keyboards. There are free and easy to use spyware utilities that come with this functionality built in, so even script kiddies can do this.
You fundamentally cannot input information securely when your method of inputting is compromised. The most a virtual keyboard can do is protect against hardware keyloggers connected to the keyboard. If something is monitoring input to a remote or virtualized machine, you've lost.
Perhaps you want to use a KVM (Keyboard Video Mouse) switch. They are devices which allow remote access to, as the name states, the keyboard, display, and mouse (and often other HIDs). These devices are simple and do not run a complex operating system, nor do they allow executing files, making them more or less immune from malicious activity. They are nothing more than an extension for your monitor and input devices.