How does the video get out? That implies a strong connection to the screen, which has a big attack surface.

This is the classic problem with isolation via virtual machines. To do anything, they have to talk to something, and that's where the security breaches occur.