Comment by dns_snek

There doesn't have to be. You can easily block all outbound traffic, or the VM can exist without any network interface at all - you can control it through its host using a serial console.