I read a similar question here on how large companies protect themselves and became intrigued about how this would transfer over to less significant operation (ie security researcher, small company, etc).
I recognize that malware analysis should not be done on machines with information of value, and that realistically, if consumer devices are being attacked, they'd have to have quite valuable information or an exploit would have been publicly released, at which point a patch probably would be as well. It appears the general consensus about VM escapes in "real life" and the is that they are too rare/difficult-to-exploit to be a threat.
So this becomes more of a theoretical question. Is there any way to guard against escapes without engineering a heavily hardened hypervisor? My first (and only, as of now) solution was VM within a VM (which is obviously going to come with the drawback of poor performance, alongside, according to this somewhat outdated serverfault thread, instability), so not ideal and I was wondering if there was a "better" way.