That wouldn’t protect you either since the risk is fraud not anything digital. None of this would have been able to happen had people not been able to get fraudulent software on his computer. If they can get software on computers that can take malicious actions, then even having it on a virtual machine won’t help you since it still needs to be connected to the internet to be useful.

An active antivirus system would have prevented this. Windows built-in antivirus system is horse dung. I’m pretty sure even the free tier of malware bites would have dealt with this.