Can a malicious application running in a container root the Android? Can a malware root the Android when running in a container such as when running through VirtualXposed or Parallel space, or when a person is using the Guest user or any other secondary user in Android? 

My device is not rooted so I can't check this on my own. If the answer is yes, how to ensure protection from such malwares that want to root your Android?
Guest Users cannot root the phone separately from the main user. If a phone is rooted it is rooted for all users. If your Recovery is not password protected anyone can easily flash Magisk and get root access on his Guest Accout. If the recovery is PW protected it will just take a few more minutes to flash the recovery again/a new one which won't have a password then. That's the big disadvantage of having an unlocked bootloader. The only way to prevent Guests from getting root access to your phone is to install MagiskManager and disactivate root access for Guest-Accounts. I don't know if this also work if the Manager is installed before rooting. If not you need to root your device first obviously.

Or just don't give your phone to someone who would root it to get access to your data or whatever lol