Here is a good example where this is not so. Unfortunately, my datacenter runs this vulnerable VMS release on an emulated VAX.

https://www.theregister.com/on-prem/2018/02/06/ghost-in-the-...