VM kernel vs dom0 kernel

What would be the difference between using a VM kernel vs using a dom0 kernel?

Is there a security difference? functionality difference?

Generally dom0 kernels are for booting the system (aka Dom0) and vm kernels are used for templates/AppVM’s.

But by default, dom0 provides the kernel, unless the settings of the AppVm are adjusted. Which is best from a security standpoint? Should the distro of the VM provide the kernel? or dom0?