What security isolation exists between VDI instance to VMware Horizon to ESX?

Question

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to those layers.