While true on one level, I'm not sure on the proof of concept - if it was just a code review or an actual exploit the finder was able to take advantage of - that level of information is somewhat missing.
In terms of public facing vms - even when properly secured, there is always a risk of a vulnerability in some other service that might allow the attacker to drop into a shell that hasn't been found or patched yet - even a fully updated guest could have a vulnerability not announced or - depending on the patch compared to upstream cycle has just not yet made it.
From what I understood of the exploit, not only would it potentially allow the vms on that host to be compromised, but you actually then have access to the host and subsequently the private networks the host connects to which is where the issue becomes significantly more concerning. The potential threat is obviously significant enough to have organizations jump on getting it patched, I'm pretty sure redhat has generated a patch for their enterprise - according to their portal, it will undergo testing and should be available for them early next week (heck, they even appear to have a detection tool for their enterprise customers to determine if they are vulnerable - I can't tell for sure how/what it does since I don't have access to that area of their web portal).
