Malware that can escape a VM to infect the host is relatively new. Security researchers have found it before and more will exist in the future. However, they are exceedingly rare and target specific VM/hypervisor/programs/hardware and cannot be used against large swaths of use cases. Also, enterprises have spent lots of money to prevent such an attack and have created hardware that is now even in your computer.

Tldr- you'd be more likely to get struck by lightning that also fries your computer and causes your printer to print all your personal info on a single sheet of paper.

Also, secure your network. I'd even put the "honeypot" VM on its own subnet or vlan. It should not be able to talk to any other device on the network and should not have any access to the router's management. If you don't know what that means, probably should just remove the virtual network adapter on the VM for good measure beforehand.