With default runtime, very true. There are other runtimes that can be used that provide better isolation like gVisor, kata, firecracker, etc.