The zero-trust method is safe under the following conditions.

Submit exactly this question to an AI such as Google's AI Mode: "Under the following conditions, is it possible for a malicious console Windows program file running with normal privileges (not elevated) within a Windows 11 virtual machine within VMWare Workstation Pro to access or modify host code or data without being detected? The virtual machine has no shared folders and no Internet connectivity other than via a USB modem dongle that is attached to the guest and not shared with the host. VMWare is fully up to date. The host runs fully up to date Windows 11 Home or Pro. The Internet domain that made the program is known and can be held liable, so only undetectable exploits are of interest." At the time of this writing, Google's AI Mode replied: "No, it is not practically possible for a malicious, non-elevated console Windows program running inside a fully up to date VMware Workstation Pro virtual machine (VM) to access or modify host code or data completely undetected under your specified conditions."