The VM isn't running in user space, it runs through the hypervisor, shell in userspace is just a convenience feature of accessing the VM that is running parallel to Android and the hypervisor enables passthrough of certain SoC features to talk directly to CPU/GPU, without traversing the android userspace.

It's like running wsl on windows, both windows and wsl are virtualized and talking to hypervisor, your wsl instance isn't running within your windows instance.