"programmers who are good at crafting defenses for their own systems know how to penetrate other people’s computers, too"
This is not strictly true. There is a big difference between identifying/exploiting bugs in software and defending a network from attack. Within the context of government spending, this is the difference between funding reverse engineering/binary analysis/buying 0days and funding the training of systems administrators.
I used virtualbox a lot for work and play, always with a debian guest. While my overall experience was good, there were two gotchas that really annoyed me:
1. When cloning VMs I would always have networking issues. The fix was known and simple (https://www.virtualbox.org/ticket/660) but not intuitive to a casual user.
2. Installing the guest additions (drag-and-drop file support, shared clipboard, basically stuff you really want) as a kernel module can be a huge pain in the ass depending on what kernel you run. I never had any issues with a "stable" 2.x kernel, but with 3.x I had a difficult time finding the correct kernel headers and putting them in the correct place.
This is not strictly true. There is a big difference between identifying/exploiting bugs in software and defending a network from attack. Within the context of government spending, this is the difference between funding reverse engineering/binary analysis/buying 0days and funding the training of systems administrators.