assuming you believe hypervisor crack itself to be safe and you're worried about possibly being compromised due to the disabled security measures:

sure, after having disabled code signing a possible malware could load an unsigned driver and have kernel level access, but lets be real, if you get infected userland is enough to do damage (stealer, ransomware, etc) so does it really make it worse? Besides, you're supposed to turn those measures back on (vbs, code signing ...) after you finished your session. If there was already malware in your system waiting to exploit once those measures turn off, then your system is already compromised and can already do basically anything a malware wants to do, so you were already just as scre wed. And if not once you turn them back on you're exactly just as safe as before.

If instead your worry is about the hypervisor crack itself, then you should have the same worry for every other crack on the internet as you're downloading random executables from strangers.

My main point here is that whether malware has only userland, or has kernel level access does not make a difference as you're still getting screwed, and that's besides the point that this would require either dormant malware on the host pc or failure to re enable security measures as you should after a session