Well the problem is that with virtualization. A guest OS is only as secure as its host OS. Which is why I presume that they don't want any WinXP or other machines that are lacking in the DRM department to be running Windows Vista virtual machines.
This is the problem that "Trusted Computing" is supposed to solve. The TCG (formerly TCPA) has an entire architecture for this laid out, that enables a "trusted boot" process, in which only a computer (or platform in TCG parlance) which has exactly the right hardware and boots exactly the right BIOS, bootloader, and OS in exactly the right sequence is allowed access to certain content, DRM keys, etc.
This system does have a number of problems (and in its current state is still victim to virtualization), and as mentioned above is very difficult to implement, but Microsoft and others are pushing very hard to make it work.