It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I would like to know specific, concrete ways in which this is the case and why. Please list some reasons along with any relevant work on whether the various reasons have been overcome manually (not using a script).
In case this question is perceived as being too general, let us focus on a specific example. The example is we are trying to use a native debugger (such as x64Dbg) to locate a call to the Windows API CreateFile and find out the location of a file write. In an unprotected program, we could open it up, place a breakpoint on CreateFile and locate the call after examining cross-referenced calls.
How would this process successfully be obstructed by Themida Protector? Obviously, at the end of the day, the program must still write the file, but what steps severely hamper analysis?