Consider a critical multi-server system (the clients are not in scope for this discussion). Each server can be a physical machine or hosted as VM.
Is there any reason to believe that the physical setup would be more secure than the virtualized equivalent, with all things being equal (e.g. room configuration, sufficient hardware resources for both approaches, etc.)?
Is there any research to claim one or the other?
Edit: For further clarification (per requests in the comments), the question is primarily targeted at potential software exploits and networking vulnerabilities with regard to the traffic between the servers. For software exploits and vulnerabilities, consider those both on OS and the application level.