Comment by pastage
When you do problems from books, you do them to get faster and to discover edge cases and that is where you learn stuff. Being able to mount a disk image is a good thing to know how to do in security research, but it is not enough.
I do not know how these exercise were made but it sounds like in the beginning they had a central server for tests probably not security things and then someone just moved that software to VMs to let the students be more flexible.
You may be right, of course. However, it's worth noting that switching to VMs changed the security posture of the exercise and it's not an encouraging sign that the cybersecurity faculty did not pick up on it.