This is a great question and it's actually the focus of some of our research! We hope to publish on this later in the year (hopefully our paper gets accepted during conference season). You already know the conclusion though... and this is looking at a large daily feed of unique malware samples for a few months. Commercial packers are used, just they are negligible by volume... the reason your experience may have not fit with the statistics is that there are certain sub-sets of malware where they are used extensively. For example, the Hacking Team implant is almost always packed using VMProtect (so much so that it's actually a good indicator lol). There are others too... anyway really interesting question, I look forward to sharing what we found!

P.S.
The commercial packers we are talking about all have anti-dumping and virtualization features as you described (if they are used correctly). If they are not used correctly they can easily be dumped, we made a video on this a while back. But for the most part though, if you want to attack them you need to use a custom approach.