"Nonsense, there are endless ways to escalate and pivot once you get local admin."

Why not report your findings to Microsoft and get your bug bounty payout?

And if this is true, wouldn't they also just do that from inside the VM?