You can run actual Windows in a hypervisor, and have all malware you want for everything inside that hypervisor, and also hypervisor escape is a thing if you have something like guest additions with access to host filesystem etc.

Attack surface is smaller.