Just to clarify, you don't mean run a VM locally, do you? If your traffic is rolling over the same insecure WiFi, I would imagine your traffic could still be connected and possibly sniffed?
I think the idea is that you can firewall the VM so none of the traffic will leak if the VPN connection is dropped. I'm sure there are easier ways to do this, though.
