VM nodes still let you do rolling OS updates for everything besides the hypervisor.

I do get you. Its why I run bare metal containers on the Harvester cluster. A whole VM just feels wasteful for some of this stuff. I also have like 12 nodes (some new, some junk, some pus) though, so I keep baremetal workloads off of hypervisor/management nodes.