That's rather a question whether a VM would be a secure server.
That's what Qubes is - a server of Fedora and Debian VMs.

Professional VM servers use other VM setups - not Qubes.