Why does a Type $2$ hypervisor typically offer less security control than a Type $1$ hypervisor?

A Type $2$ hypervisor allows users to directly perform some functions with their own access.

A Type $2$ hypervisor is always exposed to the public Internet for federated identity access.

A Type $2$ hypervisor is open source, so attackers can more easily find exploitable vulnerabilities with that access.

A Type $2$ hypervisor runs on top of another operating system and is dependent on the security of the OS for its own security.