Yes, it is entirely possible for software to break out of a virtual machine and run code on other VMs or the host. Isolating something in a virtual machine does provide rather good security, but none is perfect. Vulnerabilities have existed in many virtualization systems which allowed this to happen.
My guess is he was downvoted either for political reasons (by someone who's pro-Anonymous and mistakenly took his comment as a knock against them[1]), or because the downvoter wasn't security-savvy enough to know that gnu8's concern is legitimate.
[1] "Anonymous is not unanimous" and all that, but at the risk of No-True-Scotsmanning, either the distro is legitimately from Anonymous and contains no malware, or it contains malware and isn't legitimately from Anonymous (rather is intended as an attack against them).
