Hello,
Firstly, an attacker should not be able to gain control of the Guest via the Data Plane (where you have selfip).
However, if an attacker gain access to the management plane, he will be able to try to connect to the host or the other guest in the standard mode. When using isolation mode, all guests are isolated from each others at the network level.
All resources are dedicated to every guest except the SSL and Compression cards that share resource accross every guest.
Moreover, you can turn your guest into appliance mode to strenghten the security.